CCFR case studies
CCFR · Put your knowledge to work in context.
The Certified Cyber Forensics Responder (CCFR) is a credential listed by the McAfee Institute, a training organization accredited by the Accrediting Council for Continuing Education & Training (ACCET). The CCFR is organized around two practice areas, Cyber Forensics and Incident Response, and is intended for practitioners who examine digital evidence and coordinate the response to security incidents. The CCFR case studies are 5 cases and about 3,632 words.
1ESXi Cluster Ransomware with a Memory-Only Service and a Doubtful Backup
At 06:40 on a Saturday, monitoring shows 42 of 58 VMs across a three-host ESXi cluster unreachable and vCenter offline. An engineer finds encrypted files with a .locked extension and a README RESTORE.txt on two iSCSI datastores; all snapshots have been deleted.
869 words, about 4 min2Imaging a Failing BitLocker Drive Under Court Pressure
A departing engineer is suspected of taking source code. Her company laptop has a 500 GB NVMe drive, BitLocker-encrypted and TPM-bound, with the recovery key escrowed in Intune.
602 words, about 3 min3Business Email Compromise: Preserve Before You Clean
On Monday morning the CFO's assistant reports that supplier invoices stopped arriving. Investigation shows an inbox rule that moves any message containing 'invoice' to the RSS Feeds folder and forwards a copy to an external address.
787 words, about 4 min4Memory-Only Intrusion on a 400-Day Production Linux Host
A 32 GB RAM e-commerce web server running nginx and PHP-FPM shows a webshell that executes only from memory, with no matching file on disk. The host has 400 days of uptime, kernel 5.4, no EDR agent, and remote syslog shipping to a SIEM that normalises timestamps to receive time.
771 words, about 4 min5Insider Exfiltration, Works Council Rules and a Sealed Laptop
A finance analyst copied roughly 4 GB to a removable USB device two days before resigning. The DLP alert records the device serial, volume label and file count but not file names.
603 words, about 3 min