Course Curriculum
-
01
Introduction to Investigating Windows User Registry Artifacts
-
Before We Start
-
Windows Registry User Artifacts Introduction
-
NTUSER.DAT and USRCLASS.DAT File Extraction
-
View Files Through RegEdit – Live System
-
Extract Files Through RegEdit – Live System
-
Extract Files Through FTK Imager – Live System
-
Extract Files Through FTK Imager – Disk Image
-
Last Write Timestamps
-
Check Your Knowledge
-
-
02
Investigating Windows Registry Hives: User Artifacts
-
Application Usage - Part 1
-
Application Usage - Part 2
-
Application Usage - Part 3
-
Application Usage - Part 4
-
Check Your Knowledge
-
-
03
Internet Browsing
-
Internet Browsing
-
-
04
Search Queries
-
Search Queries
-
-
05
Other Artifacts
-
Other Artifacts
-
Check Your Knowledge
-
-
06
Exercises
-
Check Your Knowledge
-
Exercises 1 and 2
-
Exercises 1 and 2 Solutions
-
6 CPE Credits
After completing this course, you will earn:
Learning Outcomes
After completing this course, you will learn the following:
-
The ability to extract the NTUSER.DAT and USRCLASS.DAT files from the registry
-
Learning locations of various important forensic artifacts
Technical Requirements
For the hands-on labs in this course
-
Windows operating system (recommended Windows 10)
-
Internet connection
-
Installation of Registry Explorer/recmd
-
Installation of RegRipper
-
Installation of FTK Imager
What is next at Cyber 5W?
Add your email to the mailing list to get the latest updates