Home
>
Courses
>
Windows Forensics
Course

Windows Forensics

The Windows Forensics course teaches the techniques and tools to investigate and analyze digital evidence within Windows systems. It covers exploiting techniques and tools, storage, memory, registry, and log analysis. By the end of the course, students will be proficient in performing comprehensive forensic investigations and constructing detailed timelines of system events.

Hours
40 Academic Hours
Format
Online
Duration
4 Weeks

Target Audience

This program is designed for IT professionals, cybersecurity analysts, digital forensics investigators, incident responders, and system administrators with a foundational understanding of IT systems, Windows operating systems, cybersecurity fundamentals, and forensic investigation techniques.

The ideal participants are those looking to deepen their expertise in forensic analysis, specifically in Windows environments. This course is precious for individuals in roles that involve investigating security incidents, recovering and analyzing digital evidence, or auditing Windows-based systems for potential breaches. It is well-suited for professionals working in mid to largesized organizations who are responsible for ensuring the integrity and security of Windows infrastructure and need to enhance their ability to uncover and respond to malicious activities within these systems.

Required Prior Knowledge

• PowerShell

• Windows System

Computing Requirements

• CPU: Intel i5/i7 or AMD 5x/7x

• RAM: 16GB

• HDD: 300GB available space

Introduction to Windows

  • A brief History of Windows
  • Sorting Out the Different Versions and Editions
  • Windows into the Future
  • Digital Forensics in a Rapidly Changing Space

Triage Acquisiton and Analysis

  • Rapid Assesment of Windows Behavior
  • Rapid Acquisition of Artifacts
  • Windows Incident Response

Windows File System

  • TFS Internals and the Master File Table (MFT)
  • The File Allocation Table (FAT12/16/32/exFAT)
  • Generating Filesystem Timeline Scanning

Disk Image Acquisition

  • Image Acquisition Tools for Windows
  • Remote Image Acquisition
  • Master File Table (MFT) Repair

File Carving in NTFS and FAT

  • Understanding Cluster Chains
  • Understanding Alternate Data Stream (ADS)
  • The Sleuth Kit (TSK) on Windows
  • Using Autopsy

Memory Acquisition

  • Exploring Various Tools for Windows RAM Acquisition
  • Remote RAM Image Acquisition

Memory Analysis

  • Using Volatility with Windows
  • Using Mandiant’s Redline

Windows event logs (EVTX)

  • Application, security and system logs
  • Other Service Logs
  • Log Processing and Analysis with PowerShell

Registry Analysis

  • Registry file Acquisition
  • Using FTK Imager
  • Registry Structure

Active Directory Infrastructure

  • Prominent Security Features in AD
  • Well Known Weaknesses in AD
  • Windows AD Authentication and Kerberos

Active Directory Infrastructure

  • Sources of Information
  • Application, Systema and Security Logs
  • Other Logs
  • Using Log2TimeLine

Enroll

$ 4200*

$ 5400

* Special Launch Pricing - Act Fast
Enroll