Cybersecurity and ITDigital Forensics and Incident Response
The first hour of an incident determines what evidence still exists, and the instinct to reboot a compromised machine destroys most of it. This course covers responding without losing the ability to find out what happened. Delegates work through response phases and the decisions each requires, evidence identification, acquisition and the chain of custody that keeps it admissible, and volatile data capture before containment. Disk, memory and log analysis follow at a practical level. Containment, eradication and recovery are covered, including the question of when to disconnect. Reporting to management, regulators and possibly a court is addressed. The course closes on the lessons process and on preparing before an incident rather than during one.
Course objectives
- Work through the response phases and the decisions each requires
- Identify, acquire and preserve evidence with a defensible chain of custody
- Capture volatile data before containment destroys it
- Analyse disk, memory and log evidence at a practical level
- Decide on containment, eradication and recovery actions
- Report to management, regulators and legal proceedings
- Prepare a response capability before it is needed
Who should attend
- Incident responders and security analysts
- IT administrators who will be first on the scene
- Internal auditors and investigators
- Legal and compliance staff handling breaches
- Managers responsible for incident decisions
Course outline
- 01The first hour and what it destroys
- 02Response phases and decisions
- 03Evidence identification and chain of custody
- 04Volatile data capture
- 05Disk and memory analysis
- 06Log and network analysis
- 07Containment, eradication and recovery
- 08Reporting, lessons and preparation
Scheduled sessions
| Dates | Venue | Format | Price | Register |
|---|---|---|---|---|
| 21 to 25 December 2026 | Pretoria, South Africa | Classroom | R19,950 per delegate | |
| 28 December 2026 to 1 January 2027 | Lagos, Nigeria | Classroom | USD 1,325 per delegate | |
| 25 to 29 January 2027 | Casablanca, Morocco | Classroom | USD 1,325 per delegate | |
| 8 to 12 February 2027 | Online | Online | R8,500 per delegate | |
| 15 to 19 March 2027 | Cape Town, South Africa | Classroom | R19,950 per delegate |
Digital Forensics and Incident Response
From R8,500