Module 1

Before the course

1. 1.(W00) Course Instructions

Module 2

Module 1

1. 1.(W55M01) Windows Forensics First Steps
2. 2.(W55M02) Live System Analysis
3. 3.(W55M03) Module 1 Exercises (Solution)
4. 4.Practice: (W55Q01T01)
5. 5.Practice: (W55Q01T02)
6. 6.Practice: (W55Q01T04)

Module 3

Module 2

1. 1.(W55M04) Physical Imaging
2. 2.(W55M05) Logical Imaging
3. 3.(W55M06) Custom Content Imaging
4. 4.(W55M07) Image File Types - Triage - KAPE
5. 5.(W55M08) Memory Forensics
6. 6.(W55M09) Volatility Usage
7. 7.Practice: (W55M02Q06)

Module 4

Module 3

1. 1.(W55M10) NTFS File system details
2. 2.(W55M11) NTFS file system files for forensic purposes
3. 3.(W55M12) NTFS TimeStamps
4. 4.(W55M13) File system forensics
5. 5.(W55M14) Supertimelining
6. 6.(W55M15) Creating a Supertimeline
7. 7.(W55M16) File system timeline
8. 8.(W55M17) Bonus: ADS
9. 9.Practice: (W55M03Q07)

Module 5

Module 4

1. 1.(W55M18) Shortcuts (LNK Files)
2. 2.(W55M19) Jumplist
3. 3.(W55M20) Task Bar
4. 4.(W55M21) RecycleBin
5. 5.(W55M22) Thumbnails
6. 6.(W55M23) Prefetch
7. 7.(W55M24) Shimcache
8. 8.(W55M25) Amcache
9. 9.(W55M26) SRUM
10. 10.(W55M27) OBJECTS.DATA
11. 11.(W55M28) Registry
12. 12.(W55M29) Event Logs
13. 13.(W55M30) Browser Artifacts: Chrome

Module 6

Final Case Study

1. 1.(W55M31) Case Study (Compromised Host Analysis)