DFIR Diva
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A DFIR blog aimed explicitly at beginners, paired with a searchable training directory at training.dfirdiva.com that indexes over 500 free and low-cost courses across forensics, incident response, malware analysis, OSINT, Linux, networking and programming.
Who it is for, and when
The blog side is useful if you are building a route into the field or advising someone who is. The training index is the reason to bookmark it: it is the most complete curated list of genuinely free DFIR training anywhere, and it is maintained rather than dumped, so entries that go paid or go dead get corrected. Most recent post dated September 2026.
What it does not cover
It curates other people's training rather than delivering deep technical research of its own, and it does not cover expert-witness work, retention or testimony.
Go to the source
Open at dfirdiva.com (opens in a new tab)https://dfirdiva.com/
Details
- Type
- Blog or channel
- Written for
- New to the fieldWorking examinerNew to the field, Working examiner
- Topics
- training, free-training, careers, community
- Checked at source
Related entries
AboutDFIR
FreeA curated DFIR reference index — training and degree programmes, certifications, job postings, tools by platform, conferences, podcasts, preservation letter templates and research repositories — maintained by Devon Ackerman with Mary Fernandez, Tony Knutson and Nathan Turner. It also runs a near-daily news digest.
DFIR Training
Partly freeBrett Shavers' DFIR portal: a calendar of training events worldwide, a tool directory, a resource library, a book index and a blog on the state of the field. Some listings and downloads are open, others sit behind registration or a paid membership.
Antisyphon Pay What You Can Training
Partly freeAntisyphon runs selected courses on a Pay What You Can model, stating that it wants to help people who cannot afford conventional training prices. Courses confirmed on the page at the time of checking are SOC Core Skills in the Age of AI with John Strand (live and on-demand) and the Professionally Evil CISSP Mentorship Program (live, multiple instructors).
Cyber5W Free DFIR Courses
Partly freeA DFIR training company that publishes a substantial block of genuinely free self-paced courses alongside its paid catalogue. Confirmed free titles include C5W-100 Introduction to Digital Forensics, Linux Forensics Distributions, Intro to Linux from a Forensics Perspective (Ubuntu and Tsurugi), Writing Forensics Reports, Computer Data Representation, Working with Files, Prepare Your Forensic Environment, Working with Virtual Hard Disk, several Spanish-language courses on evidence acquisition and Windows forensics, and a set of case-study workshops.
A Legal Talk Network podcast hosted by Sharon D. Nelson and John W. Simek on digital forensics, ediscovery and information security for a legal audience.