Digital Forensics Challenge
The Next Digital Forensics Challenge Coming up on Sept 26th 16:00UTC - 20:00UTC
Find answers to common questions about DFIR Labs, lab access, and training options
DFIR Labs provide hands-on experience investigating real-world intrusion cases. Each lab includes telemetry data, detection alerts, and dashboards (such as Elasticsearch and Kibana) to simulate real-world investigation scenarios.
Labs are available to activate at any time within 3 months of purchase. Once a lab is activated, you can access it for the duration you selected at purchase—2, 7, or 14 days.
You have up to 3 months from the purchase date to activate any lab. There is no requirement to start immediately.
Yes, but revisiting the same lab requires using another activation. Each activation grants access for the chosen duration (2, 7, or 14 days). After the access period ends, the lab environment is removed.
A 2-day lab provides 48 continuous hours starting from the moment you activate it.
Once a lab is started, the timer runs continuously. There is currently no pause or resume feature, so we recommend starting the lab only when you're ready to begin.
We've launched a new DFIR Labs portal that allows you to manage your labs directly—no more relying on emails for access. Through the portal, you can view your purchased labs, activate them when ready, and track your remaining activations.
Access the portal here:
DFIR Labs Portal
If you'd like a quick walkthrough of the portal features, feel free to reach out—we're happy to help!
No, each DFIR Lab license is for one individual user only. Lab environments are isolated, and sharing a session between multiple users is not allowed.
Currently, there is no centralized manager dashboard for progress tracking. However, many labs include hints, instructional content, and links to public reports to support your investigation process. A progress-tracking feature is in development.
Yes. Especially for easier cases, hints and feedback are available throughout the lab to help guide your investigation and learning.
Not yet. We are looking to collaborate with educators to bring video walkthroughs to life. This is an area we're actively developing to enhance the learning experience.
Digital Forensics Challenge events feature multiple DFIR Labs cases that you can solve within a set timeframe. You will investigate real-world inspired intrusions using provided telemetry data and detection tools. These events are designed to be educational and competitive, offering both beginners and experienced analysts a chance to sharpen their skills.
No, Digital Forensics Challenge events are open to a range of skill levels. While some familiarity with intrusion analysis and security tools is helpful, many of the cases include hints and guidance to support learning along the way.
Yes, Digital Forensics Challenge events often include prizes for the top performers. The exact prize details may vary by event, so be sure to check the specific event page for up-to-date information.
You can view a list of previous Digital Forensics Challenge winners on the Digital Forensics Challenge Winners page. This page celebrates top performers and highlights their achievements in past competitions.
The leaderboard tracks participant scores across DFIR Labs cases and events. Points are typically awarded based on the difficulty of the case, completion time, and accuracy of the investigation.
No, you can gain points and appear on the leaderboard by participating in individual DFIR Labs cases, not just during Digital Forensics Challenge events.
Participants often highlight the real intrusion scenarios, the quality of the telemetry and data, and the hands-on learning approach as key benefits of DFIR Labs. Many users appreciate how the labs help them build or reinforce practical investigation skills. You can read testimonials here
Yes. DFIR Labs cases range from beginner-friendly investigations with hints and instructional content to advanced scenarios that challenge even seasoned analysts. This makes the labs a great fit for continuous learning, no matter your experience level.
Extension credits are a premium feature available to Pro and Enterprise subscribers that allow you to extend the duration of running labs beyond their original time limit. Each credit provides 24 hours of additional lab access time.
Extension credits are perfect when you:
If you've used all your monthly extension credits, you can:
Yes, we offer a monthly subscription that gives you access to all available labs, including both public and private labs.
Yes. We offer enterprise subscription plans designed to support organizations that want to provide ongoing DFIR training for their teams. These subscriptions provide access to our full catalog of labs with flexible token allocations and extension credits for all team members.
Enterprise subscriptions are ideal for:
For more details on enterprise options and pricing, contact our sales team.
Enterprise accounts can purchase additional blocks of tokens within their active subscription year if their initial allocation is depleted. Contact our sales team for assistance.
If you have other questions or need assistance, feel free to reach out to us via our Contact Page.
Our team is here to help with any questions you may have.
Contact Us