Loading…
FORENSYRA
Where Digital Truth Takes Form
> initialising forensyra shell_
000% · SECURING SESSION
NoticeApplications are open — join the founding team and help build the first student-led DFIR collective.
Thirteen Roles
All thirteen specialisations, in one place. Every member owns a defined role — pick the one that fits you.
All 13 Roles
Numbered 01 to 13. Roles are filled in phases — phase 1 builds the core team, phase 2 grows the collective. Expand any role to see what the work involves, the key responsibilities, and the skills and tools we look for.
Not sure which role is yours?
Six questions. We map your answers against all thirteen specialisations.
Leads the case, assigns work, validates findings, and approves the final investigation report.
The work
Leads the case end to end: direction, tasking, validation, final approval.
Responsibilities
Skills & tools
Manages meetings, attendance, task tracking, member onboarding, announcements, and team operations.
The work
Keeps the collective running day to day.
Responsibilities
Skills & tools
Reviews legal, ethical, privacy, consent, and digital evidence handling considerations for each mock case.
The work
Reviews cases for legal, ethical and privacy soundness.
Responsibilities
Skills & tools
Records, hashes, protects, tracks, and verifies all evidence files and working copies.
The work
Owns evidence integrity from acquisition to verification.
Responsibilities
Skills & tools
Investigates Windows/Linux computers for logs, files, browser data, USB activity, persistence, and user actions.
The work
Works the host: filesystem, registry, logs, USB and browser artefacts.
Responsibilities
Skills & tools
Analyses PCAPs and network logs to identify suspicious traffic, attacker communication, and data exfiltration.
The work
Reconstructs the attack over the wire from PCAPs and logs.
Responsibilities
Skills & tools
Examines RAM dumps and suspicious files to identify malicious processes, malware behaviour, and persistence.
The work
Examines volatile evidence and suspicious binaries.
Responsibilities
Skills & tools
Researches and enriches suspicious IPs, domains, URLs, hashes, attacker methods, and related threat information.
The work
Adds context and attribution to artefacts and indicators.
Responsibilities
Skills & tools
Builds the incident timeline and converts validated findings into reports, slides, and case documentation.
The work
Turns scattered artefacts into a coherent timeline and report.
Responsibilities
Skills & tools
Investigates cloud logs, IAM changes, account activity, storage access, API events, and cloud-based attacks.
The work
Follows evidence into cloud environments and audit logs.
Responsibilities
Skills & tools
Examines image, video, and audio evidence for metadata, integrity, editing signs, and deepfake risks.
The work
Verifies image, video and audio evidence.
Responsibilities
Skills & tools
Investigates AI misuse, prompt injection, AI API logs, synthetic-media risks, and AI-related data exposure.
The work
Investigates AI misuse and AI-related data exposure.
Responsibilities
Skills & tools
Investigates Android/iOS artefacts such as calls, messages, app data, media, location, browser history, and backups.
The work
Recovers and interprets mobile artefacts.
Responsibilities
Skills & tools
Claim a Role
Applications are open for the founding team. Choose the specialisation that fits you best.
Specialise
Contribute
Grow