Free Digital Forensics Analyst Roadmap

Recover, preserve and explain what happened on a machine or a network. Security+ first, then disk, network, memory, malware and document forensics, CySA+ for the incident-response side, and the deepest lab series on the platform. Practice exams for CHFI, EC-Council's forensics certification, are under Practice tests: practice questions only, not a CHFI course.

6 steps · 92 free videos · 5 free reads

Start step 1 →

Create your free account to open all 2,396 free items

The 97 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.

Create free account →Already have an account? Sign in

The free roadmap

6 steps, in order

The 🔒 rows show what the full roadmap adds at each step. StationX Membership opens every course and its labs: $299 / year ($24.92/mo billed annually). Infrastructure Labs labs are a separate add-on.

Start here →
Step 1 — Security foundation
The baseline every forensics role lists.
Follow the free CompTIA Security+ (SY0-701) roadmap.
🔒 The full roadmap adds here: 6 full courses · hands-on labs 1–148 of 362 (courses in Membership · 71 labs in Membership · 77 labs in Infrastructure Labs)
- Course · CompTIA Security+ Certification (SY0-701): The Total Course · 🔒 Membership
- Course · Security+ (SY0-701) - Self-paced Course! · 🔒 Membership
- Course · CompTIA Security+ SY0-701: General Security Concepts · 🔒 Membership
- Course · CompTIA Security+: Viruses, Threats and Compromise Indicators · 🔒 Membership
- Course · CompTIA Security+ Labs · 🔒 Membership
- Course · Security+ Just Labs: The Ultimate Hands-On Bootcamp · 🔒 Membership
- Lab 1 of 362 · Additional Scanning Options · 🔒 Membership
- Lab 2 of 362 · Basics of Metasploit · 🔒 Membership
- Lab 3 of 362 · BCP DRP and Test Planning · 🔒 Membership
- Lab 4 of 362 · BitLocker Setup · 🔒 Membership
- Lab 5 of 362 · Block Incoming Traffic on Known Port · 🔒 Membership
- Lab 6 of 362 · Comparing Controls · 🔒 Membership
- Lab 7 of 362 · Creating a List of Installed Programs, Services and User Accounts from a WIN2K12 Server · 🔒 Membership
- Lab 8 of 362 · Creation of BCP and DRP · 🔒 Membership
- Lab 9 of 362 · Data Backup to Prep for Recovery · 🔒 Membership
- Lab 10 of 362 · Event Log · 🔒 Membership
- Lab 11 of 362 · Host Data Integrity Baselining · 🔒 Membership
- Lab 12 of 362 · Installing Patches and Testing Software · 🔒 Membership
- Lab 13 of 362 · MITRE - Attack · 🔒 Membership
- Lab 14 of 362 · MITRE - Defend · 🔒 Membership
- Lab 15 of 362 · Network Discovery · 🔒 Membership
- Lab 16 of 362 · Network Segmentation (FW/DMZ/WAN/LAN) · 🔒 Membership
- Lab 17 of 362 · Network Topology Generation · 🔒 Membership
- Lab 18 of 362 · Open Source Collection · 🔒 Membership
- Lab 19 of 362 · Open Source Password Cracking · 🔒 Membership
- Lab 20 of 362 · Scanning From Windows · 🔒 Membership
- Lab 21 of 362 · Windows Event Log Manipulation via Windows Event Viewer · 🔒 Membership
- Lab 22 of 362 · Wireshark · 🔒 Membership
- Lab 23 of 362 · Manage Users and Groups in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 24 of 362 · Manage Users and Groups in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 25 of 362 · Can You Manage Users and Groups in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 26 of 362 · Configure Password Management in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 27 of 362 · Configure Password Management in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 28 of 362 · Can You Manage Password Requirements in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 29 of 362 · Configure Standard Linux Permissions [Guided] · 🔒 Infrastructure Labs
- Lab 30 of 362 · Configure Standard Windows Permissions [Guided] · 🔒 Infrastructure Labs
- Lab 31 of 362 · Can You Configure Standard Linux and Windows Permissions? [Advanced] · 🔒 Infrastructure Labs
- Lab 32 of 362 · Can You Manage Access in Linux and Windows? [Expert] · 🔒 Infrastructure Labs
- Lab 33 of 362 · Can You Harden the SSH Service on a Linux Server? [Advanced} · 🔒 Infrastructure Labs
- Lab 34 of 362 · Force Users to Change Password Upon First Sign In [Guided] · 🔒 Infrastructure Labs
- Lab 35 of 362 · Remove a User Account [Guided] · 🔒 Infrastructure Labs
- Lab 36 of 362 · Can You Add Server Access for a Group? [Advanced] · 🔒 Infrastructure Labs
- Lab 37 of 362 · Examine Log Files to Block Bad Actors [Guided] · 🔒 Infrastructure Labs
- Lab 38 of 362 · Harden a Server by Limiting Access to a Single Subnet [Guided] · 🔒 Infrastructure Labs
- Lab 39 of 362 · Can You Harden a Server by Restricting Access per Protocol? [Advanced] · 🔒 Infrastructure Labs
- Lab 40 of 362 · Can You Harden a Linux Web Server? [Expert] · 🔒 Infrastructure Labs
- Lab 41 of 362 · Deploy a Private Certificate Authority [Guided] · 🔒 Infrastructure Labs
- Lab 42 of 362 · Configure Custom Certificate Templates and Deployment Options [Guided] · 🔒 Infrastructure Labs
- Lab 43 of 362 · Manually Request a PKI Certificate [Guided] · 🔒 Infrastructure Labs
- Lab 44 of 362 · Can You Deploy a Certificate Authority and Issue Certificates? [Advanced] · 🔒 Infrastructure Labs
- Lab 45 of 362 · Enable DNSSEC [Guided] · 🔒 Infrastructure Labs
- Lab 46 of 362 · Use EFS To Encrypt Files on NTFS Volumes [Guided] · 🔒 Infrastructure Labs
- Lab 47 of 362 · Can You Secure DNS Resource Records and Windows NTFS Volume File Objects? [Advanced] · 🔒 Infrastructure Labs
- Lab 48 of 362 · Enable SSL/TLS on a Website [Guided] · 🔒 Infrastructure Labs
- Lab 49 of 362 · Enable Client SSL/TLS [Guided] · 🔒 Infrastructure Labs
- Lab 50 of 362 · Can You Secure a Website with an SSL/TLS Certificate? [Advanced] · 🔒 Infrastructure Labs
- Lab 51 of 362 · Can You Use PKI to Secure a Network Environment? [Expert] · 🔒 Infrastructure Labs
- Lab 52 of 362 · Cryptography: Attacking Classic Ciphers · 🔒 Membership
- Lab 53 of 362 · Cryptography: Breaking Repeated Key XOR Cipher · 🔒 Membership
- Lab 54 of 362 · Cryptography: Breaking Weak RSA Keys · 🔒 Membership
- Lab 55 of 362 · Cryptography: Decrypting Files With a Dictionary Attack · 🔒 Membership
- Lab 56 of 362 · Cryptography: Forging Digital Signatures · 🔒 Membership
- Lab 57 of 362 · Cryptography: Forging MACs With Side Channels · 🔒 Membership
- Lab 58 of 362 · Cryptography: Hidden Veracrypt Containers · 🔒 Membership
- Lab 59 of 362 · Cryptography: Man In the Middle Attack · 🔒 Membership
- Lab 60 of 362 · Cryptography: Password Cracking · 🔒 Membership
- Lab 61 of 362 · Cryptography: Setting Up HTTPS in Windows and Linux · 🔒 Membership
- Lab 62 of 362 · Cryptography: Setting Up Two Factor Authentication · 🔒 Membership
- Lab 63 of 362 · Cryptography: Steganography · 🔒 Membership
- Lab 64 of 362 · Cryptography: Using GPG for Encryption and Key Management · 🔒 Membership
- Lab 65 of 362 · Cryptography: Using the OpenSSL CLI Tool · 🔒 Membership
- Lab 66 of 362 · Getting Started with Security Concepts in Windows and Linux Environments [Getting Started] · 🔒 Infrastructure Labs
- Lab 67 of 362 · Configure Windows Firewall ACL Rules [Guided] · 🔒 Infrastructure Labs
- Lab 68 of 362 · Configure Linux Firewall ACL Rules [Guided] · 🔒 Infrastructure Labs
- Lab 69 of 362 · Configure Security Settings by Using Microsoft Group Policy [Guided] · 🔒 Infrastructure Labs
- Lab 70 of 362 · Identify Non-secure Network Traffic [Guided] · 🔒 Infrastructure Labs
- Lab 71 of 362 · Can You Secure Host Settings Through Firewall Settings and Group Policy? [Advanced] · 🔒 Infrastructure Labs
- Lab 72 of 362 · Configure IPSec [Guided] · 🔒 Infrastructure Labs
- Lab 73 of 362 · Configure a Windows PPTP VPN [Guided] · 🔒 Infrastructure Labs
- Lab 74 of 362 · Can You Secure Network Access? [Advanced] · 🔒 Infrastructure Labs
- Lab 75 of 362 · Can You Harden Windows Hosts? [Expert] · 🔒 Infrastructure Labs
- Lab 76 of 362 · Back Up and Restore Data in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 77 of 362 · Back Up and Restore Data in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 78 of 362 · Can You Back Up and Restore Data in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 79 of 362 · Configure and Test the Firewall in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 80 of 362 · Configure and Test the Firewall in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 81 of 362 · Can You Configure the Firewall in Linux and Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 82 of 362 · Configure Patch Management in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 83 of 362 · Configure Update Management in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 84 of 362 · Can You Configure Update Management in Linux and Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 85 of 362 · Can You Manage Windows and Linux Systems? [Expert] · 🔒 Infrastructure Labs
- Lab 86 of 362 · Applying Filters to TCPDump and Wireshark · 🔒 Membership
- Lab 87 of 362 · DNS as a Remote Shell · 🔒 Membership
- Lab 88 of 362 · Firewall Setup and Configuration · 🔒 Membership
- Lab 89 of 362 · Gap Analysis of Firewall Rules · 🔒 Membership
- Lab 90 of 362 · Implementing Least-Privilege on Windows · 🔒 Membership
- Lab 91 of 362 · Setting Up Zones in a Firewall · 🔒 Membership
- Lab 92 of 362 · Snorby Setup and Operation · 🔒 Membership
- Lab 93 of 362 · TCPDump · 🔒 Membership
- Lab 94 of 362 · Tweaking Firewall Rules for Detection · 🔒 Membership
- Lab 95 of 362 · Using Snort and Wireshark to Analyze Traffic · 🔒 Membership
- Lab 96 of 362 · Getting Started with Cybersecurity Defensive Tools [Getting Started] · 🔒 Infrastructure Labs
- Lab 97 of 362 · Managing Log Files on a Windows Server [Guided] · 🔒 Infrastructure Labs
- Lab 98 of 362 · Configure Windows Defender on a Windows System [Guided] · 🔒 Infrastructure Labs
- Lab 99 of 362 · Configure a Local Security Policy on Server 2016 [Guided] · 🔒 Infrastructure Labs
- Lab 100 of 362 · Can You Use the Sysinternals Suite to Review Permissions on a Windows System? [Advanced] · 🔒 Infrastructure Labs
- Lab 101 of 362 · Using Encryption to Secure Information [Guided] · 🔒 Infrastructure Labs
- Lab 102 of 362 · Can You Configure Drive Encryption by Using LUKS and BitLocker? [Advanced] · 🔒 Infrastructure Labs
- Lab 103 of 362 · Can You Configure Remote Administration by Using PuTTY and SSH? [Expert] · 🔒 Infrastructure Labs
- Lab 104 of 362 · Use a Password Cracking Utility in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 105 of 362 · Can You Use PowerShell to Gather Computer Information in Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 106 of 362 · Escalate Privileges in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 107 of 362 · Can You Enumerate Network Services by Using Port Scanning in Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 108 of 362 · Auditing Service Accounts and Setting Up Automated Log Collection · 🔒 Membership
- Lab 109 of 362 · Centralized Monitoring · 🔒 Membership
- Lab 110 of 362 · CIRP Creation and Disaster · 🔒 Membership
- Lab 111 of 362 · Creation of Standard Operating Procedures for Recovery · 🔒 Membership
- Lab 112 of 362 · Data Downloads and Validation · 🔒 Membership
- Lab 113 of 362 · Force Point: DLP Email Overview · 🔒 Membership
- Lab 114 of 362 · Force Point: DLP Network Overview · 🔒 Membership
- Lab 115 of 362 · Identifying Key Assets · 🔒 Membership
- Lab 116 of 362 · Leveraging Internal Intelligence Resources · 🔒 Membership
- Lab 117 of 362 · Log Correlation & Analysis to Identify Potential IOC · 🔒 Membership
- Lab 118 of 362 · Monitoring and Verifying Management Systems · 🔒 Membership
- Lab 119 of 362 · Open and Close Ports on Windows 7 · 🔒 Membership
- Lab 120 of 362 · Phishing · 🔒 Membership
- Lab 121 of 362 · Post Incident Service Restoration · 🔒 Membership
- Lab 122 of 362 · Ransomware · 🔒 Membership
- Lab 123 of 362 · Recover from SQL Injection Attack · 🔒 Membership
- Lab 124 of 362 · Sensitive Information Identification · 🔒 Membership
- Lab 125 of 362 · Vulnerability Identification and Remediation · 🔒 Membership
- Lab 126 of 362 · Use Git to Manage Code [Guided] · 🔒 Infrastructure Labs
- Lab 127 of 362 · Analyze Log Files for Malicious Activity [Guided] · 🔒 Infrastructure Labs
- Lab 128 of 362 · Identify and Manage Old Software [Guided] · 🔒 Infrastructure Labs
- Lab 129 of 362 · Deploy a Docker Container [Guided] · 🔒 Infrastructure Labs
- Lab 130 of 362 · Deploy a Virtual Machine [Guided] · 🔒 Infrastructure Labs
- Lab 131 of 362 · Configure a Jump Box [Guided] · 🔒 Infrastructure Labs
- Lab 132 of 362 · Manage File Redundancy for Resilience and Recovery [Guided] · 🔒 Infrastructure Labs
- Lab 133 of 362 · Manage System Restore Using Windows 11 [Guided] · 🔒 Infrastructure Labs
- Lab 134 of 362 · Use Alerting and Monitoring Tools [Guided] · 🔒 Infrastructure Labs
- Lab 135 of 362 · Digitally Sign Code To Verify Authenticity [Guided] · 🔒 Infrastructure Labs
- Lab 136 of 362 · Configure a Wireless Access Point [Guided] · 🔒 Infrastructure Labs
- Lab 137 of 362 · Sanitize Storage Disks [Guided] · 🔒 Infrastructure Labs
- Lab 138 of 362 · Enhance Security by Using SELinux [Guided] · 🔒 Infrastructure Labs
- Lab 139 of 362 · Manage Configurations by Using Ansible [Guided] · 🔒 Infrastructure Labs
- Lab 140 of 362 · Configure Devices by Using Ansible [Guided] · 🔒 Infrastructure Labs
- Lab 141 of 362 · Perform Security Audits on Linux Services [Guided] · 🔒 Infrastructure Labs
- Lab 142 of 362 · Baseline Systems in Accordance with Policy Documentation · 🔒 Membership
- Lab 143 of 362 · Conduct Baseline Comparison for Indicators of Compromise · 🔒 Membership
- Lab 144 of 362 · Creating a Baseline Using Autopsy · 🔒 Membership
- Lab 145 of 362 · Creating a Secondary Baseline and Conducting Comparison · 🔒 Membership
- Lab 146 of 362 · Manually Creating a Baseline with MD5Deep · 🔒 Membership
- Lab 147 of 362 · Recovering Data and Data Integrity Checks · 🔒 Membership
- Lab 148 of 362 · Windows Deployment Services · 🔒 Membership
See this step on the full roadmap →
Step 2 — Forensics foundations
Acquire and handle evidence so it survives scrutiny.
- Digital Forensics for Pentesters - Hands-on Learning
  Free video lesson · courses.stationx.net
  A free lesson from this course. Explore the full roadmap.
  - Course OverviewVideo lesson · courses.stationx.net · 2 min
- 6 Free Tools to Image a Drive So the Evidence Holds UpVideo · 1 min
- What Is Digital Forensics?Article · stationx.net · 11 min read
🔒 The full roadmap adds here: 1 full course · hands-on labs 149–173 of 362 (Membership)
- Course · Digital Forensics for Pentesters - Hands-on Learning · 🔒 Membership
- Lab 149 of 362 · Analyze and Update a Company BCP/BIA/DRP/CIRP · 🔒 Membership
- Lab 150 of 362 · Analyze Packed Executable to Identify Attack Vector and Payload · 🔒 Membership
- Lab 151 of 362 · Creating a Case in Autopsy · 🔒 Membership
- Lab 152 of 362 · Creating a Case in OSF · 🔒 Membership
- Lab 153 of 362 · FTK Analysis & Reporting · 🔒 Membership
- Lab 154 of 362 · FTK Enterprise Fundamentals and Mobile Investigation · 🔒 Membership
- Lab 155 of 362 · Metadata Extraction Lab · 🔒 Membership
- Lab 156 of 362 · Password Cracking with PRTK · 🔒 Membership
- Lab 157 of 362 · Registry Analysis · 🔒 Membership
- Lab 158 of 362 · Virtualization · 🔒 Membership
- Lab 159 of 362 · Analyze Malicious Network Traffic · 🔒 Membership
- Lab 160 of 362 · Compromise Assessment with Crowd Response · 🔒 Membership
- Lab 161 of 362 · Conduct Log Analysis and Cross Examination for False Positives · 🔒 Membership
- Lab 162 of 362 · Creating a Forensic Image · 🔒 Membership
- Lab 163 of 362 · Data Recovery with Autopsy · 🔒 Membership
- Lab 164 of 362 · Detect the Introduction of a Malicious Application · 🔒 Membership
- Lab 165 of 362 · Identify Access to a LINUX Firewall Through SYSLOG Service · 🔒 Membership
- Lab 166 of 362 · Identify and Remove Trojan Using Various Tools · 🔒 Membership
- Lab 167 of 362 · Identify Suspicious Information in VM Snapshots · 🔒 Membership
- Lab 168 of 362 · Identify Whether High-Risk Systems Were Affected · 🔒 Membership
- Lab 169 of 362 · Live Imaging with FTK Imager and Data Recovery with Autopsy · 🔒 Membership
- Lab 170 of 362 · Manually Analyze Malicious PDF Documents · 🔒 Membership
- Lab 171 of 362 · Manually Analyze Malicious PDF Documents 2 · 🔒 Membership
- Lab 172 of 362 · Memory Extraction and Analysis · 🔒 Membership
- Lab 173 of 362 · Participate in Attack Analysis Using Trusted Tool Set · 🔒 Membership
See this step on the full roadmap →
Step 3 — Network forensics
Reconstruct what crossed the wire.
- Master Wireshark 3 in 5 Days
  4 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - 1. OverviewVideo lesson · courses.stationx.net · 3 min
  - 5. Export packetsVideo lesson · courses.stationx.net · 5 min
  - 2. Wireshark throughout historyVideo lesson · courses.stationx.net · 3 min
  - 14. Capture optionsVideo lesson · courses.stationx.net · 4 min
- Wireshark Cheat SheetCheat sheet · stationx.net
- What Is a PCAP File?Article · stationx.net · 11 min read
🔒 The full roadmap adds here: 1 full course · hands-on labs 174–187 of 362 (Membership)
- Course · Master Wireshark 3 in 5 Days · 🔒 Membership
- Lab 174 of 362 · Analyze Browser-based Heap Spray Attack · 🔒 Membership
- Lab 175 of 362 · Automated in-Depth Packet Decoding · 🔒 Membership
- Lab 176 of 362 · Clonezilla_Network · 🔒 Membership
- Lab 177 of 362 · Identifying Intrusion and Mitigating Attacks with RHEL Server · 🔒 Membership
- Lab 178 of 362 · Identifying Malicious Callbacks · 🔒 Membership
- Lab 179 of 362 · Identifying Malicious Network Connections · 🔒 Membership
- Lab 180 of 362 · Incident Detection and Identification · 🔒 Membership
- Lab 181 of 362 · Nexpose: Analysis & Reporting (Executive, High Risk and Recommendation Reporting) · 🔒 Membership
- Lab 182 of 362 · Parse Files Out of Network Traffic · 🔒 Membership
- Lab 183 of 362 · Searching for Indicators of Compromise · 🔒 Membership
- Lab 184 of 362 · Setting up Filters and Queries in Kibana · 🔒 Membership
- Lab 185 of 362 · Use pfTop to Analyze Network Traffic · 🔒 Membership
- Lab 186 of 362 · Verify Attributes of Identified SilentBanker Intrusion · 🔒 Membership
- Lab 187 of 362 · Verify Attributes of Intrusion Through Additional Analysis · 🔒 Membership
See this step on the full roadmap →
Step 4 — Malware, memory and document analysis
Take apart the binary, the memory image or the booby-trapped document at the centre of the case.
- Reverse Engineering & Malware Analysis - Intermediate Level
  3 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - 10. Using API Hooking to Analyze Malware - PandaBankerVideo lesson · courses.stationx.net · 18 min
  - 27. Dridex - part 3 - Self-Injection and Process Hacker DumpingVideo lesson · courses.stationx.net · 7 min
  - 1. IntroductionVideo lesson · courses.stationx.net · 5 min
- Malware Analysis Of Malicious Documents
  3 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - 1. Intro to the courseVideo lesson · courses.stationx.net · 7 min
  - 30. Lab: A walkthrough on debugging a malicious office documentVideo lesson · courses.stationx.net · 12 min
  - 19. Lab: Using peepdfVideo lesson · courses.stationx.net · 7 min
- Reverse Engineering: Cutter for Beginners
  2 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - Downloading Cutter, installing and testing itVideo lesson · courses.stationx.net · 3 min
  - IntroductionVideo lesson · courses.stationx.net · 7 min
- Win32 Reverse Engineering
  4 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - CPU and RAMVideo lesson · courses.stationx.net · 32 min
  - IDA ProVideo lesson · courses.stationx.net · 13 min
  - Assembly LanguageVideo lesson · courses.stationx.net · 28 min
  - Video OverviewVideo lesson · courses.stationx.net · 8 min
- Reverse Engineering 5: Reversing Visual Basic
  3 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - Intro to VB P-CodeVideo lesson · courses.stationx.net · 5 min
  - Patching P-CodeVideo lesson · courses.stationx.net · 15 min
  - IntroductionVideo lesson · courses.stationx.net · 4 min
- Reverse Engineering and Memory Hacking with Cheat Engine
  3 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - How to hack a CrackMe Using AOB Code InjectionVideo lesson · courses.stationx.net · 20 min
  - How to identify User Modules vs System Modules and Understanding Windows APIVideo lesson · courses.stationx.net · 17 min
  - IntroductionVideo lesson · courses.stationx.net · 7 min
- Learn Ethical Hacking & Reverse Engineering
  7 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - 24. Sid/Intro (Cookie tampering to bypass login)Video lesson · courses.stationx.net · 3 min
  - 27. SQLi1/SQLi (Bypassing login page password using SQL Injection Attack)Video lesson · courses.stationx.net · 8 min
  - 2. Registering for an account with defendtheweb.netVideo lesson · courses.stationx.net · 2 min
  - 75. Crack the Serial Key using BP on stringsVideo lesson · courses.stationx.net · 9 min
  - 9. [NEW] Intro 6 (Client code modification vulnerability)Video lesson · courses.stationx.net · 4 min
  - 12. Intro 9 (Client code modification vulnerability)Video lesson · courses.stationx.net · 4 min
  - 1. IntroductionVideo lesson · courses.stationx.net · 5 min
- Reverse Engineering & Malware Analysis of .NET & Java
  2 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - 8. Lab Demo: Disassembling with ildasm and Patching with ilasmVideo lesson · courses.stationx.net · 7 min
  - 1. IntroductionVideo lesson · courses.stationx.net · 6 min
- Game Hacking: Cheat Engine Game Hacking Basics
  4 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - Memory Scanning For Ammo and the Freeze TechniqueVideo lesson · courses.stationx.net · 6 min
  - Introduction to Pointers and Data StructuresVideo lesson · courses.stationx.net · 12 min
  - Installing Cheat EngineVideo lesson · courses.stationx.net · 7 min
  - IntroductionVideo lesson · courses.stationx.net · 4 min
- Reverse Engineering 2: Windows GUI Programs
  5 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - 3. Analyzing PE filesVideo lesson · courses.stationx.net · 4 min
  - 6. Windows API functionsVideo lesson · courses.stationx.net · 7 min
  - 11. Breakpoints from Call StackVideo lesson · courses.stationx.net · 4 min
  - 18. Removing Nag screen 1Video lesson · courses.stationx.net · 9 min
  - 1. IntroductionVideo lesson · courses.stationx.net · 4 min
- Reverse Engineering: Create Your Own GUI CrackMe using C++
  2 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - 11. Building a Crackme that Autogenerates Serial-Key Based On Name and DateVideo lesson · courses.stationx.net · 22 min
  - 1. IntroductionVideo lesson · courses.stationx.net · 7 min
- Reverse Engineering, Memory Hacking and Software Protection
  2 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - Introduction to Memory HackingVideo lesson · courses.stationx.net · 6 min
  - IntroductionVideo lesson · courses.stationx.net · 7 min
- Reverse Engineering: IDA For Beginners
  3 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - Debugging and Patching Using IDAVideo lesson · courses.stationx.net · 13 min
  - Introduction 1Video lesson · courses.stationx.net · 6 min
  - Reversing Jumps and NOPs - Crackme3Video lesson · courses.stationx.net · 10 min
- Reverse Engineering: Ghidra For Beginners
  4 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - Reversing GUI CrackMe's, Function Graphs, Function Call Trees, WinMain, StringsVideo lesson · courses.stationx.net · 22 min
  - Reversing WorkflowsVideo lesson · courses.stationx.net · 4 min
  - Decompiling Code and Renaming SymbolsVideo lesson · courses.stationx.net · 11 min
  - IntroductionVideo lesson · courses.stationx.net · 7 min
- Malware Development and Reverse Engineering 1 : The Basics
  4 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - 29. Introduction to Trojan EngineeringVideo lesson · courses.stationx.net · 13 min
  - 26. Intro to Function Obfuscation Using GetProcAddress APIVideo lesson · courses.stationx.net · 11 min
  - 9. 1-intro to embedding shellcode payloadVideo lesson · courses.stationx.net · 12 min
  - 1. IntroductionVideo lesson · courses.stationx.net · 7 min
- Reverse Engineering Windows GUI Programs
  4 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - Windows API functionsVideo lesson · courses.stationx.net · 7 min
  - Breakpoints from Call StackVideo lesson · courses.stationx.net · 4 min
  - Removing Nag screensVideo lesson · courses.stationx.net · 3 min
  - Analyzing the PE fileVideo lesson · courses.stationx.net · 4 min
- Android Malware Analysis in Kali
  3 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - Android Security ArchitectureVideo lesson · courses.stationx.net · 2 min
  - Why AndroidVideo lesson · courses.stationx.net · 2 min
  - IntroductionVideo lesson · courses.stationx.net · 3 min
- Reverse Engineering and Software Protection
  3 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - 8. Creating a LoaderVideo lesson · courses.stationx.net · 10 min
  - 2. Introduction to Software ProtectionVideo lesson · courses.stationx.net · 10 min
  - 1. IntroductionVideo lesson · courses.stationx.net · 4 min
- Reverse Engineering .NET with dnSpy
  3 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - 5. Patching with dnSpyVideo lesson · courses.stationx.net · 9 min
  - 4. Introduction to crackme 18Video lesson · courses.stationx.net · 3 min
  - 1. IntroductionVideo lesson · courses.stationx.net · 3 min
- x64dbg Static Analysis for Reverse Engineering Beginners
  3 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - Introduction to static analysisVideo lesson · courses.stationx.net · 3 min
  - How to use x64dbg to disassemble and generate graphical viewVideo lesson · courses.stationx.net · 10 min
  - IntroductionVideo lesson · courses.stationx.net · 4 min
- x64dbg Debugger for Reverse Engineering Beginners
  2 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - Debugger Stepping BasicsVideo lesson · courses.stationx.net · 27 min
  - IntroductionVideo lesson · courses.stationx.net · 2 min
- Mobile Security: Reverse Engineer Android Apps From Scratch
  3 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - 41. Simplocker: Automated AnalysisVideo lesson · courses.stationx.net · 5 min
  - 6. Android StudioVideo lesson · courses.stationx.net · 3 min
  - 1. Course overviewVideo lesson · courses.stationx.net · 3 min
- Reverse Engineering with Radare2
  5 free video lessons · courses.stationx.net
  Free lessons from this course. Explore the full roadmap.
  - What is Radare2?Video lesson · courses.stationx.net · 3 min
  - Navigating in the BinaryVideo lesson · courses.stationx.net · 14 min
  - Cross ReferencesVideo lesson · courses.stationx.net · 9 min
  - Cutter the R2 GUIVideo lesson · courses.stationx.net · 26 min
  - IntroductionVideo lesson · courses.stationx.net · 3 min
- 7 Files That Lie About What They AreVideo · 1 min
- 5 Commands That Tell You If a File Is MalwareVideo · 2 min
- 7 CLI Tools to Reveal What Is Inside a Suspicious FileVideo · 1 min
- 7 Free Tools That Find Data Hidden Inside an ImageVideo · 1 min
- 6 Free Tools That Pull Evidence Straight Out of MemoryVideo · 1 min
- 7 Tools to Find What Attackers Left in MemoryVideo · 1 min
- 7 Tools to Reverse Engineer Any BinaryVideo · 1 min
- 7 Tools to Pull Malware Out of RAMVideo · 1 min
- Steganography - Hiding Data from the FBIVideo · 10 min
- What Is Reverse Engineering in Cyber Security?Article · stationx.net · 13 min read
- What Is Steganography? How to Hide Data Like a SpyArticle · stationx.net · 14 min read
🔒 The full roadmap adds here: 3 full courses · hands-on labs 188–205 of 362 (Membership)
- Course · Reverse Engineering: Ghidra For Beginners · 🔒 Membership
- Course · Reverse Engineering & Malware Analysis - Intermediate Level · 🔒 Membership
- Course · Malware Analysis Of Malicious Documents · 🔒 Membership
- Lab 188 of 362 · Advanced Techniques for Malware Recovery · 🔒 Membership
- Lab 189 of 362 · Analysis and Recommendation Report · 🔒 Membership
- Lab 190 of 362 · Analyze and Classify Malware · 🔒 Membership
- Lab 191 of 362 · Analyze DoomJuice Infection to Identify Attack Vector and Payload · 🔒 Membership
- Lab 192 of 362 · Analyze Malicious Activity in Memory Using Volatility · 🔒 Membership
- Lab 193 of 362 · Conduct Root Cause Analysis for System Crashes · 🔒 Membership
- Lab 194 of 362 · Detect Embedded Shellcode in a Microsoft Office Document · 🔒 Membership
- Lab 195 of 362 · Dynamic Malware Analysis · 🔒 Membership
- Lab 196 of 362 · Fundamentals of Malware Analysis · 🔒 Membership
- Lab 197 of 362 · Linux Analysis · 🔒 Membership
- Lab 198 of 362 · Log Analysis · 🔒 Membership
- Lab 199 of 362 · MAC Analysis · 🔒 Membership
- Lab 200 of 362 · Practical Malware Analysis Labs · 🔒 Membership
- Lab 201 of 362 · Recover from Incident · 🔒 Membership
- Lab 202 of 362 · Remove Trojan · 🔒 Membership
- Lab 203 of 362 · Reverse Engineering Malware · 🔒 Membership
- Lab 204 of 362 · RootKit · 🔒 Membership
- Lab 205 of 362 · Validate Indications of Compromise: Analysis of PE File · 🔒 Membership
See this step on the full roadmap →
Step 5 — Incident response, certified
Forensics feeds the response: the analyst certification and its incident-response labs.
Follow the free CompTIA CySA+ (CS0-004) roadmap.
🔒 The full roadmap adds here: 2 full courses · hands-on labs 206–332 of 362 (courses in Membership · 64 labs in Membership · 63 labs in Infrastructure Labs)
- Course · TOTAL: CompTIA CySA+ Cybersecurity Analyst (CS0-004) · 🔒 Membership
- Course · CompTIA CySA+ Labs · 🔒 Membership
- Lab 206 of 362 · Analyze Various Data Sources to Confirm Suspected Infection · 🔒 Membership
- Lab 207 of 362 · Assessing Vulnerabilities Post Addressal · 🔒 Membership
- Lab 208 of 362 · BitCoin Mining Web Application on Corporate Network · 🔒 Membership
- Lab 209 of 362 · Check for Indicators of Other Attack Activity (Debug PE File) · 🔒 Membership
- Lab 210 of 362 · Cyber Security Evaluation Tool (CSET) · 🔒 Membership
- Lab 211 of 362 · Entering Information into a CMDB · 🔒 Membership
- Lab 212 of 362 · Event Logs with Autopsy · 🔒 Membership
- Lab 213 of 362 · Internet History · 🔒 Membership
- Lab 214 of 362 · Nexpose: Red Team Exploitation · 🔒 Membership
- Lab 215 of 362 · Overview of Kibana · 🔒 Membership
- Lab 216 of 362 · Performing an Initial Attack Analysis · 🔒 Membership
- Lab 217 of 362 · Preparing Target Media · 🔒 Membership
- Lab 218 of 362 · Recover from Illegal Bitcoin Mining Incident · 🔒 Membership
- Lab 219 of 362 · Recover from Web-Based Flashpack Incident · 🔒 Membership
- Lab 220 of 362 · Report Writing for Presentation to Management · 🔒 Membership
- Lab 221 of 362 · Respond to and Validate Alerts from Antivirus Software · 🔒 Membership
- Lab 222 of 362 · WMI Event Persistence · 🔒 Membership
- Lab 223 of 362 · Comprehensive Threat Response · 🔒 Membership
- Lab 224 of 362 · Conduct Supplemental Monitoring · 🔒 Membership
- Lab 225 of 362 · Create Custom Snort Rules · 🔒 Membership
- Lab 226 of 362 · Monitoring for False Positives · 🔒 Membership
- Lab 227 of 362 · Monitoring Network Traffic · 🔒 Membership
- Lab 228 of 362 · Monitoring Network Traffic for Potential IOA/IOC · 🔒 Membership
- Lab 229 of 362 · SNORT Configuration and Operation Lab · 🔒 Membership
- Lab 230 of 362 · Perform Network Scanning [Guided] · 🔒 Infrastructure Labs
- Lab 231 of 362 · Use SSH for Remote Access [Guided] · 🔒 Infrastructure Labs
- Lab 232 of 362 · Use Wireshark Filters to Explore Captured Network Traffic [Guided] · 🔒 Infrastructure Labs
- Lab 233 of 362 · Perform Application Source Code Verification [Guided] · 🔒 Infrastructure Labs
- Lab 234 of 362 · Perform Log Analysis [Guided] · 🔒 Infrastructure Labs
- Lab 235 of 362 · Find Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 236 of 362 · Assess Cybersecurity Templates and Benchmarks [Guided] · 🔒 Infrastructure Labs
- Lab 237 of 362 · Can You Discover Vulnerabilities Over a Network? [Advanced] · 🔒 Infrastructure Labs
- Lab 238 of 362 · Can You Establish Secure Communications by Using SSH and Wireshark? [Advanced] · 🔒 Infrastructure Labs
- Lab 239 of 362 · Can You Manage Threats by Using Source Code, Logs, and Security Templates? [Advanced] · 🔒 Infrastructure Labs
- Lab 240 of 362 · Can You Reduce Threats by Using Nmap, SSH, Source Code Analysis, and Security Templates? [Expert] · 🔒 Infrastructure Labs
- Lab 241 of 362 · Utilize Network Analysis Tools [Guided] · 🔒 Infrastructure Labs
- Lab 242 of 362 · Use Security Monitoring Tools [Guided] · 🔒 Infrastructure Labs
- Lab 243 of 362 · Perform Email Header Analysis [Guided] · 🔒 Infrastructure Labs
- Lab 244 of 362 · Evaluate Network Logging [Guided] · 🔒 Infrastructure Labs
- Lab 245 of 362 · Display Files by Performing Forensic Analysis Tasks [Guided] · 🔒 Infrastructure Labs
- Lab 246 of 362 · Evaluate the Output of Enumeration Tools [Guided] · 🔒 Infrastructure Labs
- Lab 247 of 362 · Evaluate Credential Security [Guided] · 🔒 Infrastructure Labs
- Lab 248 of 362 · Can You Capture and Analyze Network Traffic and Logging by Performing Management Tasks? [Advanced] · 🔒 Infrastructure Labs
- Lab 249 of 362 · Can You Evaluate Account Security Threats? [Advanced] · 🔒 Infrastructure Labs
- Lab 250 of 362 · Can You Perform Forensic Analysis Tasks to Display Files? [Advanced] · 🔒 Infrastructure Labs
- Lab 251 of 362 · Can You Capture and Analyze Network Traffic? [Expert] · 🔒 Infrastructure Labs
- Lab 252 of 362 · Event Log Collection with QRadar · 🔒 Membership
- Lab 253 of 362 · QRADAR - Auditing Service Accounts and Generating SIEM Reports · 🔒 Membership
- Lab 254 of 362 · QRadar - Centralized Monitoring · 🔒 Membership
- Lab 255 of 362 · QRADAR - Collecting Logs and Verifying Syslog Aggregation with pfSense · 🔒 Membership
- Lab 256 of 362 · QRadar - IDS Setup and Configuration · 🔒 Membership
- Lab 257 of 362 · QRadar - Log Correlation & Analysis to Identify Potential IOC · 🔒 Membership
- Lab 258 of 362 · QRadar - Log Correlation & Analysis to Identify Potential IOC with Custom Log Types · 🔒 Membership
- Lab 259 of 362 · QRADAR - Setting Up SYSLOG Forwarding From a Windows System · 🔒 Membership
- Lab 260 of 362 · QRadar - Snort Signatures, IDS Tuning, and Blocking · 🔒 Membership
- Lab 261 of 362 · Perform Network Scanning and Reconnaissance [Guided] · 🔒 Infrastructure Labs
- Lab 262 of 362 · Implement Intrusion Detection by Using Wazuh [Guided] · 🔒 Infrastructure Labs
- Lab 263 of 362 · Configure and Manage SSH to Establish Secure Connections [Guided] · 🔒 Infrastructure Labs
- Lab 264 of 362 · Manage Incidents by Using Incident Response Tools [Guided] · 🔒 Infrastructure Labs
- Lab 265 of 362 · Configure Secure HTTP Services [Guided] · 🔒 Infrastructure Labs
- Lab 266 of 362 · Configuring VPN Services [Guided] · 🔒 Infrastructure Labs
- Lab 267 of 362 · Can You Improve Security by Using Network Scanning, Sniffing, and GPOs? [Advanced] · 🔒 Infrastructure Labs
- Lab 268 of 362 · Can You Implement Intrusion Detection by Using Wazuh? [Advanced] · 🔒 Infrastructure Labs
- Lab 269 of 362 · Can You Improve Network Security with SSH, HTTPS, and IPSec? [Advanced] · 🔒 Infrastructure Labs
- Lab 270 of 362 · Can You Use Snort and SSH? [Expert] · 🔒 Infrastructure Labs
- Lab 271 of 362 · Analyze SQL Injection Attack · 🔒 Membership
- Lab 272 of 362 · Core Impact Web Application Penetration Testing · 🔒 Membership
- Lab 273 of 362 · Creating Recommendations Based on Vulnerability Assessments · 🔒 Membership
- Lab 274 of 362 · Identifying System Vulnerabilities with OpenVAS · 🔒 Membership
- Lab 275 of 362 · Manual Vulnerability Assessment · 🔒 Membership
- Lab 276 of 362 · Penetration Tester Challenge · 🔒 Membership
- Lab 277 of 362 · Phishing · 🔒 Membership
- Lab 278 of 362 · Preliminary Scanning · 🔒 Membership
- Lab 279 of 362 · Threat Designation · 🔒 Membership
- Lab 280 of 362 · Vulnerability Proof of Concept and Remediation · 🔒 Membership
- Lab 281 of 362 · Vulnerability Scanning with GVM · 🔒 Membership
- Lab 282 of 362 · Windows System Hardening with Group Policy & Active Directory · 🔒 Membership
- Lab 283 of 362 · Windows System Hardening with PowerShell · 🔒 Membership
- Lab 284 of 362 · Use Reconnaissance Tools to Perform Network Scanning [Guided] · 🔒 Infrastructure Labs
- Lab 285 of 362 · Perform Network Scanning to Find Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 286 of 362 · Implement a Host-Based Intrusion Detection System [Guided] · 🔒 Infrastructure Labs
- Lab 287 of 362 · Implement Snort to Evaluate Network Communications [Guided] · 🔒 Infrastructure Labs
- Lab 288 of 362 · Harden Network Security [Guided] · 🔒 Infrastructure Labs
- Lab 289 of 362 · Perform Web Server Vulnerability Scans [Guided] · 🔒 Infrastructure Labs
- Lab 290 of 362 · Establish Secure Communications Between Systems by Using SSH for Remote Access [Guided] · 🔒 Infrastructure Labs
- Lab 291 of 362 · Can You Perform Network and Vulnerability Scanning? [Advanced] · 🔒 Infrastructure Labs
- Lab 292 of 362 · Can You Implement a Host-Based Intrusion Detection System? [Advanced] · 🔒 Infrastructure Labs
- Lab 293 of 362 · Can You Manage Network, Web, and Remote Access Security? [Advanced] · 🔒 Infrastructure Labs
- Lab 294 of 362 · Can You Use Snort, IPSec, Wireshark, Nikto, Nmap, and Wapiti to Identify Network Vulnerabilities? [Expert] · 🔒 Infrastructure Labs
- Lab 295 of 362 · Using the OWASP Zed Attack Proxy Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 296 of 362 · Using the Burp Suite Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 297 of 362 · Use the Nikto Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 298 of 362 · Use the Arachni Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 299 of 362 · Use Web Application Scanners [Advanced] · 🔒 Infrastructure Labs
- Lab 300 of 362 · Use Greenbone Security Manager to Identify Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 301 of 362 · Use Nmap for Enumeration [Guided] · 🔒 Infrastructure Labs
- Lab 302 of 362 · Use hping for Enumeration [Guided] · 🔒 Infrastructure Labs
- Lab 303 of 362 · Use Responder for Enumeration [Guided] · 🔒 Infrastructure Labs
- Lab 304 of 362 · Hash Verification · 🔒 Membership
- Lab 305 of 362 · Implement Single System Changes in Firewall · 🔒 Membership
- Lab 306 of 362 · Introduction to Squert · 🔒 Membership
- Lab 307 of 362 · Log Event Reports · 🔒 Membership
- Lab 308 of 362 · Microsoft Baseline Security Analyzer · 🔒 Membership
- Lab 309 of 362 · Vulnerability Analysis/Protection · 🔒 Membership
- Lab 310 of 362 · WebApp Attack PCAP Analysis · 🔒 Membership
- Lab 311 of 362 · Perform Log Analysis and Task Automation [Guided] · 🔒 Infrastructure Labs
- Lab 312 of 362 · Perform Backup Options to Allow for Lost File Restoration [Guided] · 🔒 Infrastructure Labs
- Lab 313 of 362 · Implement New Security Policies [Guided] · 🔒 Infrastructure Labs
- Lab 314 of 362 · Explore Network Traffic by Using Wireshark [Guided] · 🔒 Infrastructure Labs
- Lab 315 of 362 · Find Network System Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 316 of 362 · Evaluate and Customize Security Policy Templates [Guided] · 🔒 Infrastructure Labs
- Lab 317 of 362 · Perform Open Source Intelligence (OSINT) Gathering Operations [Guided] · 🔒 Infrastructure Labs
- Lab 318 of 362 · Can You Manage Logs with Scripts, Perform File Restoration, and Perform Vulnerability Scans? [Advanced] · 🔒 Infrastructure Labs
- Lab 319 of 362 · Can You Use GPOs and Security Templates as Part of IR? [Advanced] · 🔒 Infrastructure Labs
- Lab 320 of 362 · Can You Examine Network Communications by Using Incident Response Tools? [Advanced] · 🔒 Infrastructure Labs
- Lab 321 of 362 · Can You Perform File Restoration, Manage GPOs, and Perform OSINT? [Expert] · 🔒 Infrastructure Labs
- Lab 322 of 362 · Collecting Logs and Verifying Syslog Aggregation · 🔒 Membership
- Lab 323 of 362 · Creating SIEM Reports with Splunk · 🔒 Membership
- Lab 324 of 362 · Disable User Account on Windows 10 · 🔒 Membership
- Lab 325 of 362 · IDS Setup and Configuration · 🔒 Membership
- Lab 326 of 362 · Linux Users and Groups · 🔒 Membership
- Lab 327 of 362 · Log Correlation · 🔒 Membership
- Lab 328 of 362 · Protect Against Beaconing · 🔒 Membership
- Lab 329 of 362 · Setting Up SYSLOG Forwarding From a Windows System · 🔒 Membership
- Lab 330 of 362 · Vulnerability Scanner Set-up and Configuration · 🔒 Membership
- Lab 331 of 362 · Vulnerability Scanner Set-up and Configuration with OpenVAS · 🔒 Membership
- Lab 332 of 362 · Whitelist Comparison · 🔒 Membership
See this step on the full roadmap →
Step 6 — Casework, end to end
Run full investigations at series scale.
Hands-on step: the labs for it are on the full roadmap.
🔒 The full roadmap adds here: hands-on labs 333–362 of 362 (Membership)
- Lab 333 of 362 · Auditing Service Accounts · 🔒 Membership
- Lab 334 of 362 · Control Assessment and Evaluation · 🔒 Membership
- Lab 335 of 362 · Creating a Case in FTK · 🔒 Membership
- Lab 336 of 362 · Denial of Service PCAP Analysis · 🔒 Membership
- Lab 337 of 362 · Event Log Collection with Splunk · 🔒 Membership
- Lab 338 of 362 · Host Identification Scanning via Windows · 🔒 Membership
- Lab 339 of 362 · Host Identification Scanning with Linux · 🔒 Membership
- Lab 340 of 362 · Implement Single System Changes in Firewall · 🔒 Membership
- Lab 341 of 362 · Import Nexpose Vulnerability Data into QRadar · 🔒 Membership
- Lab 342 of 362 · Intro to Linux - Routing and SSH Tunnels · 🔒 Membership
- Lab 343 of 362 · Lab Environment Orientation - *** (Start Here!) *** · 🔒 Membership
- Lab 344 of 362 · Live Imaging with FTK Imager Lite · 🔒 Membership
- Lab 345 of 362 · LNX101 - OpenSSH Installation, Configuration, and Hardening · 🔒 Membership
- Lab 346 of 362 · LNX101 - Setting Up a Firewall With UFW and Firewalld · 🔒 Membership
- Lab 347 of 362 · LNX101 - Telnet vs. SSH · 🔒 Membership
- Lab 348 of 362 · Nessus Scanning and Reporting · 🔒 Membership
- Lab 349 of 362 · Nexpose: Blue Team Remediation · 🔒 Membership
- Lab 350 of 362 · PAM Lab · 🔒 Membership
- Lab 351 of 362 · Patching With WSUS · 🔒 Membership
- Lab 352 of 362 · Pentesting & Network Exploitation - Linux Target Analysis Labs · 🔒 Membership
- Lab 353 of 362 · Recovery From Inadequate Patching · 🔒 Membership
- Lab 354 of 362 · Rogue Device Identification and Blocking · 🔒 Membership
- Lab 355 of 362 · Scanning with Nmap · 🔒 Membership
- Lab 356 of 362 · Securing Linux - Firewalls · 🔒 Membership
- Lab 357 of 362 · Securing Linux for System Administrators · 🔒 Membership
- Lab 358 of 362 · Snap Exploit · 🔒 Membership
- Lab 359 of 362 · Snort Signatures, IDS Tuning, and Blocking · 🔒 Membership
- Lab 360 of 362 · Specialized Linux Port Scans · 🔒 Membership
- Lab 361 of 362 · Whitelist IP Address from IDS Alerts · 🔒 Membership
- Lab 362 of 362 · Windows Event Log Manipulation via Windows Event Viewer · 🔒 Membership
See this step on the full roadmap →
Try a free forensics lab: The leaver's laptop (~4 min) → A scripted simulation in your browser. No account needed.

Do it hands-on

The full Digital Forensics Analyst roadmap

The same steps with every course and the hands-on labs, and your progress tracked.

The full roadmap with labs →What Membership includes · Full refund within 30 days if you haven't started a lab · cancel anytime

Advanced

AI-Driven Security Engineering

Become the Cyber Security Expert the AI Era Needs.

StationX’s AI Master’s teaches you to create and deploy security solutions by directing AI. “No coding background required. You direct the AI; the AI does the building.”

Explore the AI Master’s →