Course outline(W55M13) File system forensics

Your course

Windows Forensics (W55)

Module 1

Before the course

  1. 1.(W00) Course Instructions

Module 2

Module 1

  1. 1.(W55M01) Windows Forensics First Steps
  2. 2.(W55M02) Live System Analysis
  3. 3.(W55M03) Module 1 Exercises (Solution)
  4. 4.Practice: (W55Q01T01)
  5. 5.Practice: (W55Q01T02)
  6. 6.Practice: (W55Q01T04)

Module 3

Module 2

  1. 1.(W55M04) Physical Imaging
  2. 2.(W55M05) Logical Imaging
  3. 3.(W55M06) Custom Content Imaging
  4. 4.(W55M07) Image File Types - Triage - KAPE
  5. 5.(W55M08) Memory Forensics
  6. 6.(W55M09) Volatility Usage
  7. 7.Practice: (W55M02Q06)

Module 4

Module 3

  1. 1.(W55M10) NTFS File system details
  2. 2.(W55M11) NTFS file system files for forensic purposes
  3. 3.(W55M12) NTFS TimeStamps
  4. 4.(W55M13) File system forensics
  5. 5.(W55M14) Supertimelining
  6. 6.(W55M15) Creating a Supertimeline
  7. 7.(W55M16) File system timeline
  8. 8.(W55M17) Bonus: ADS
  9. 9.Practice: (W55M03Q07)

Module 5

Module 4

  1. 1.(W55M18) Shortcuts (LNK Files)
  2. 2.(W55M19) Jumplist
  3. 3.(W55M20) Task Bar
  4. 4.(W55M21) RecycleBin
  5. 5.(W55M22) Thumbnails
  6. 6.(W55M23) Prefetch
  7. 7.(W55M24) Shimcache
  8. 8.(W55M25) Amcache
  9. 9.(W55M26) SRUM
  10. 10.(W55M27) OBJECTS.DATA
  11. 11.(W55M28) Registry
  12. 12.(W55M29) Event Logs
  13. 13.(W55M30) Browser Artifacts: Chrome

Module 6

Final Case Study

  1. 1.(W55M31) Case Study (Compromised Host Analysis)
Course overview
Module 4Lesson 4

(W55M13) File system forensics

Lesson videoLocked

Member lesson

Unlock the full lesson

Sign in to watch and unlock the course materials.