TryHackMe DFIR rooms¶

About¶

Interactive tutorials and investigations with guided tasks (Windows/Linux forensics, log analysis).

The format¶

• Learn by doing: Hands-on from minute one.

• Beginner-friendly: Step-by-step walkthroughs available.

• Varied scenarios: From dead-box analysis to live triage.

Example room:

“Investigate a compromised web server, find how they got in and what they stole.”

Rooms worked through¶

• A Windows server

• Organisation X desktop

• Standard Collector Analysis (Redline)

• IOC Search Collector (Redline)

• IOC Search Collector Analysis (Redline)

• Endpoint investigation (Redline)

• Leaking private company data (again) (Autopsy)

• Windows 10 disk image (Autopsy)

• Acceptable Use Policy violation (KAPE)

• BOB! THIS ISN’T A HORSE! (Volatility)

• That Kind of Hurt my Feelings (Volatility)

• Hunt for a nightmare (Volatility)

• Android malware analysis (Pithus and jadx)

• iOS forensics (SQLiteDB)