Products
-
Investigating Windows Program Executions
Investigate Windows execution artifacts like Prefetch, AmCache, ShimCache, UserAssist & BAM in hands-on labs. Learn tool-based analysis and forensic significance of each artifact. Ideal for DFIR analysts.
Digital Forensics & Incident Response
$50
-
Time Zone Conversions
4.5 average rating (2 reviews)This course covers the required digital forensic skills to inspect and understand the different timestamps that could be seen during an investigation and learn how to convert between timezones.
Digital Forensics & Incident Response
Free
-
Investigating Windows LNK Files and JumpLists
Investigate Windows LNK and JumpList artifacts in hands‑on labs. Learn to parse .lnk files and JumpLists, trace file usage, determine storage paths, even for deleted files. Essential training in user activity forensic analysis.
Digital Forensics & Incident Response
$50
-
Investigating Windows Thumb Caches
Dive into Windows thumbnail cache forensics using hands‑on labs. Learn to analyze Thumbs.db and thumbcache_xxx.db, uncover hidden file previews, and reconstruct user activity. Ideal for DFIR analysts and forensic investigators.
Digital Forensics & Incident Response
$50
-
Investigating Windows System Registry Artifacts
Explore key Windows system registry artifacts using hands‑on virtual labs. Learn how to extract SYSTEM hive files from live systems or disk images, analyze AppCompatCache, Autoruns, network and user data, and uncover critical forensic evidence.
Digital Forensics & Incident Response
$50
-
Investigating Windows User Registry Artifacts
Dive into Windows user registry forensics. Extract and analyze NTUSER.DAT and USRCLASS.DAT to trace application usage, browsing, search queries, and more, via hands-on labs that help you build accurate user activity timelines.
Digital Forensics & Incident Response
$50