Course Description
Dive into the critical world of Windows forensics with this bootcamp designed for investigators and cybersecurity professionals. This intensive training focuses on practical, hands-on labs to uncover and analyze forensic artifacts generated by user and process interactions within the Windows operating system.
What You’ll Learn:Whether you’re a beginner or looking to sharpen your skills, this crash course equips you with the tools and techniques to efficiently investigate Windows environments.
Syllabus
The course covers Windows forensics essentials, including artifacts, registry, USB investigations, shadow copies, and system events.
- Windows Basics
- Users and Groups
- Parsing SID Manually
- Recycle Bin
- Thumbnails
- LNK Files and Jump Lists
- System and User Program Activity
- Prefetch Files
- UserAssist
- Background Activity Moderator (BAM)
- System Resource Usage Monitor (SRUM)
- and Other Subjects
- Windows Registry
- Structure of Windows Registry
- System Artifacts
- User Artifacts
- Investigating USB Thumb Drives
- Analyzing Shellbags
- Volume Shadow Copies & File History
- Windows Events
- Windows Scheduled Tasks
- Windows Search
Windows Forensic Analysis
Instructor
Ali Hadi is a highly accomplished Senior Cybersecurity Specialist with over 14 years of professional experience in Information Technology. He currently serves as the Research Director at the Leahy Center for Digital Forensics and Cybersecurity, and as the Digital Forensics Program Director at Champlain College, USA. In his role at the Leahy Center, Ali focuses his research on Digital Forensics and Incident Response (DFIR) and Adversary Simulation. Additionally, he is a full-time professor and researcher at Champlain College's Digital Forensics and Cybersecurity Departments. Ali is also a Co-Founder of Cyber 5W. He holds a PhD and MSc in Computer Information Systems, alongside a BSc in Computer Science. Throughout his career, Ali has earned over 20 professional certifications. His expertise spans digital forensics, incident response, adversary simulation, offensive security, and malware analysis. As a sought-after consultant in cybersecurity, Ali offers his knowledge to various organizations, including government agencies and private sector firms. He is an established author, speaker, and freelance instructor, providing technical training across multiple sectors. Ali's commitment to the digital forensics community is unwavering, as he continues to promote forensics education and research. More details could be found here.
Learning Objectives
After completing this course, the student will be able to perform the following:
-
Ability to investigate Windows Basic Artifacts
-
Understand Timestamps & Timezone Conversions
-
Investigating Windows Program Execution Artifacts
-
Investigating Windows Registry and Windows Shellbags
-
Investigating USB Thumb Drives
-
Volume Shadow Copies & File History
-
Working with Windows Events Logs
-
Investigating Windows Scheduled Tasks & Windows Notifications
Prerequisites
The Value of the Training
Cancellation Policy:
Info you need to know to get a refund