NoticeApplications are open — join the founding team and help build the first student-led DFIR collective.
The People
Members hold defined roles and work the part of each case that matches their specialisation.
The Roster
Each of the thirteen roles has two member slots. Filled seats show the member; empty seats are open to apply for.
Leads the case, assigns work, validates findings, and approves the final investigation report.
Manages meetings, attendance, task tracking, member onboarding, announcements, and team operations.
Reviews legal, ethical, privacy, consent, and digital evidence handling considerations for each mock case.
Records, hashes, protects, tracks, and verifies all evidence files and working copies.
Investigates Windows/Linux computers for logs, files, browser data, USB activity, persistence, and user actions.
Analyses PCAPs and network logs to identify suspicious traffic, attacker communication, and data exfiltration.
Examines RAM dumps and suspicious files to identify malicious processes, malware behaviour, and persistence.
Researches and enriches suspicious IPs, domains, URLs, hashes, attacker methods, and related threat information.
Builds the incident timeline and converts validated findings into reports, slides, and case documentation.
Investigates cloud logs, IAM changes, account activity, storage access, API events, and cloud-based attacks.
Examines image, video, and audio evidence for metadata, integrity, editing signs, and deepfake risks.
Investigates AI misuse, prompt injection, AI API logs, synthetic-media risks, and AI-related data exposure.
Join the Collective
Pick a role, practise on legal mock cases, and publish real work as part of a team.
Real Cases
Real Skills
Real Impact