Incident Response
IR playbooks, breach response, forensics, regulator notification timelines.
Module 2 · Disk Imaging — Forensically Sound Acquisition
Why this module exists. “We made a copy of the disk” is not the same as “we forensically imaged the disk.” The…
Incident ResponseRansomware Economics 2026 — Payment Rates Down, Pressure Up, India Now Top-5 Victim Geography
Ransomware economics in 2026: payment rates dropped to 28%, average payment rose to K, exfil-only model replacing classic encrypt-and-extort. Affiliate economy structure,…
AcademyDisaster Recovery — RTO, RPO, Recovery Testing
RTO/RPO tiers, DR architecture patterns (active-active, hot standby, pilot light, backup-restore), drill methodology, ransomware-specific DR, the 3-2-1-1-0 backup rule.
AcademyDigital Forensics and Chain of Custody
Order of volatility, RAM and disk imaging, NTFS/Linux artefacts, cloud forensics, mobile forensics, IT Act §65B, BSA admissibility — the practitioner forensic…
AcademyBusiness Continuity and Disaster Recovery
BCP and DR end-to-end — BIA, RTO/RPO, recovery strategies, plan documentation, drill cadence, ransomware-aware DR, and the operational discipline that makes plans…
Blue TeamVolatility Memory Forensics: A Walkthrough for IR Teams
Volatility 3 workflow for incident response — memory capture (WinPmem, AVML), high-leverage plugins (pstree, netscan, malfind, hashdump, lsadump), real-world analysis pattern, anonymised…