• 

  Investigating Windows LNK Files and JumpLists

• 

  Investigating Windows Thumb Caches

• 

  Investigating Windows System Registry Artifacts

• 

  Investigating Windows User Registry Artifacts

• 

  Investigating Windows Shellbags

• 

  Investigating USB Thumb Drives

• 

  Volume Shadow Copies (VSC)

• 

  Investigating Windows Scheduled Tasks

• 

  Windows Event Logs

• 

  Employee Policy Violation Case #2

• 

  Encrypted Files Case #1

• 

  BSides Amman 2021 Windows Forensics Workshop