Skip to main content
Dantes.io Logo
Dantes.io

Best resources to learnDigital Forensics & Incident Analysis

Study sheet

Digital forensics recovers and analyses evidence from computers, phones and networks. You will learn disk and memory forensics, log analysis, chain of custody and the tooling used in investigations.

6 resources · · How we curate

📺YouTube(1)

youtube

13Cubed (YouTube channel)

This is the best free video path into hands-on forensic work. Each episode walks through a specific artefact with real tools, which complements the theory in the books. Free DFIR video series by a Microsoft forensic investigator. It covers Windows artefacts (Prefetch, ShimCache, SRUM, jump lists), memory forensics with Volatility, Linux and macOS forensics, and timeline analysis, all shown with real tools on sample evidence.

intermediate🇬🇧

📚Books(2)

bookPaid

File System Forensic Analysis

A detailed technical reference on how disk partitions and file systems (FAT, NTFS, Ext2/3, UFS) store data. This is the canonical disk-forensics text, recommended again and again in DFIR communities. File-system internals have barely changed, so the 2005 edition still serves as the reference. It shows how to recover deleted files and metadata. The author wrote The Sleuth Kit and Autopsy.

advanced🇬🇧
bookPaid

The Art of Memory Forensics

Explains how to acquire and analyze RAM from Windows, Linux, and Mac systems using Volatility, covering process, network, registry, and rootkit artifacts. Readers gain a repeatable method for finding malware that never touches disk.

intermediate🇬🇧

🌐Websites(2)

website

The DFIR Report

Free, detailed reconstructions of real intrusions, mostly ransomware and malware campaigns. Each report traces the attacker from initial access to impact, with timelines, event-log and memory evidence, detection rules and indicators. The site has published 85+ public reports.

advanced🇬🇧
website

SANS Hunt Evil Poster (Windows Forensic Analysis Reference)

This is a compact, trusted reference that working analysts keep at their desks. It gives some of the value of the $8k+ SANS courses at no cost. Free SANS DFIR reference poster listing the normal parent processes, paths, user accounts and instance counts of core Windows processes. Analysts use it to spot malicious or impersonated processes during memory and live-response analysis.

intermediate🇬🇧

📄Papers(1)

paper

NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response

This is the primary-source framework the topic note asks for (chain of custody, the collect-examine-analyse-report process). NIST's reference guide to the forensic process in incident response: collection, examination, analysis and reporting. It covers evidence handling and chain of custody, and treats files, operating systems, network traffic and applications as separate data sources. It dates from 2006, so its tool specifics are old, but the methodology still holds.

beginner🇬🇧
Share this topic

More in Cybersecurity

See all 17 topics in Cybersecurity →

Frequently Asked Questions

What are the best free resources to learn Digital Forensics & Incident Analysis?

Dantes has curated 6 resources for Digital Forensics & Incident Analysis, including 1 YouTube videos, 2 books, 2 websites, 1 papers. All resources are hand-picked for quality — no algorithmic filler. Browse the full list above to find the format that works best for you.

Is Digital Forensics & Incident Analysis hard to learn?

Digital Forensics & Incident Analysis is approachable at the beginner level — there are resources here specifically for those starting from scratch. As you progress, intermediate and advanced material is also available to take your skills further.

What types of Digital Forensics & Incident Analysis learning resources are available on Dantes?

For Digital Forensics & Incident Analysis, Dantes has curated 1 YouTube videos, 2 books, 2 websites, 1 papers. Each resource type serves a different learning style: videos and YouTube for visual learners, books for depth, courses for structured progression, and websites for quick reference.

How does Dantes select Digital Forensics & Incident Analysis resources?

Dantes is an algorithm-free learning directory. Resources are hand-curated based on quality, accuracy, and usefulness — not engagement metrics or paid placements. The goal is to surface the best learning material for Digital Forensics & Incident Analysis, whether it's a free YouTube series, a classic textbook, or an open courseware from a top university.

Go deeper

Test your understanding of Digital Forensics & Incident Analysis

Explain it out loud. An AI tutor listens and asks questions that expose gaps you didn't know you had.