Complete DFIR course: digital forensics and incident response. Three phases: Host Forensics (Windows, Linux, macOS), Memory Forensics (Volatility, Rekall), Network Forensics (Zeek, Suricata, PCAP). Timeline Analysis (Plaso, Timesketch), Malware Triage (static + dynamic), Evidence Collection (FTK Imager, KAPE, Velociraptor), Threat Hunting (MITRE ATT&CK mapping), Incident Response Playbooks (NIST SP 800-61 alignment).