DFIR: An Introduction

Walkthrough summary

DFIR: An Introduction TryHackMe walkthrough with 7 answered prompts and lab methodology notes.

Sample prompts covered

• What does DFIR stand for?
  Open the walkthrough page to inspect the full answer and command flow.
• DFIR requires expertise in two fields. One of the fields is Digital Forensics. What is the other field?
  Open the walkthrough page to inspect the full answer and command flow.
• From amongst the RAM and the hard disk, which storage is more volatile?
  Open the walkthrough page to inspect the full answer and command flow.
• Complete the timeline creation exercise in the attached static site. What is the flag that you get after completion?
  Open the walkthrough page to inspect the full answer and command flow.
• At what stage of the IR process are disrupted services brought back online as they were before the incident?
  Open the walkthrough page to inspect the full answer and command flow.