Trainings

In a lot of real-world investigations, the browser ends up telling the story more clearly than the host logs do. Session cookies, OAuth tokens, saved credentials, synced profile data, extension artifacts, IndexedDB, and download metadata often show exactly what an attacker accessed, how they moved through SaaS environments, and what they were able to maintain over time. Despite that, browser forensics still gets treated as a side topic in many DFIR workflows.
This three-day hands-on training is built around the idea that the browser should be treated as a primary forensic source, not an afterthought. The first two days focus on the artifacts that matter most across Chrome, Edge, Firefox, and Safari, with an emphasis on how they are actually used in incident response. That includes credential store decryption in Chromium-based browsers, session and token analysis for adversary-in-the-middle phishing cases, extension triage, cloud-synced profile recovery, and download-chain reconstruction.
The third day is dedicated to using AI in a way that is genuinely useful during an investigation. Not as a replacement for the analyst, but as a force multiplier. Attendees will use AI to work through exported artifacts, build timelines faster, surface anomalies worth pursuing, and speed up reporting. They will also build lightweight, task-driven workflows using agents, skills, and MCP-style patterns to automate parts of browser forensic collection and analysis while keeping analyst validation firmly in the loop. By the end of the course, attendees will have built and used AI-assisted investigative workflows they can adapt to their own cases.
The training concludes with a 2.5-hour breach investigation in which attendees receive a realistic artifact set and reconstruct attacker activity using the browser forensic tradecraft from the first two days and the AI-assisted workflows they built on the final day.