Membership

Windows Registry and Log Analysis (W31)

Investigate Windows Registry artifacts and logs. Develop a practical approach to interpreting records of system configuration and user activity. This is an earlier course edition; examples reflect the tools and versions used when it was recorded.

Instructor · Luca Cadonici

Modules:
6
Lessons:
44

eForensics learning

Practical skills.
Verified progress.

What you'll learn

  • Extract investigative information from the Windows Registry.
  • Collect and analyze logs with PowerShell and Log Parser.
  • Connect Registry and log artifacts with system activity.

Prerequisites

Intermediate use of the Windows operating system Intermediate understanding of the Windows operating system Basic concepts of Computer Forensics (imaging, hashing) Basic understanding of networking (TCP/IP, IP addressing, routing, DNS, DHCP) Basic concepts of IT security Equipment and software: A Workstation running Windows 7, 8 or 10. FTK Imager 4.1.1 http://accessdata.com/product-download/ftk-imager-version-4.1.1 Log Parser 2.2 https://www.microsoft.com/en-us/download/details.aspx?id=24659 Registry Viewer 1.8.1.3 (demo version) http://accessdata.com/product-download/registry-viewer-1.8.1.3 PowerShell 5.0 https://docs.microsoft.com/en-us/powershell/wmf/5.1/install-configure

Module 3

Module 1

  1. 1. (W31M01) An introduction to Windows Logging

  2. 2. (W31M02) The EVTX files

  3. 3. (W31M02V01) The EVTX files Video

  4. 4. (W31M03) Getting started with PowerShell

  5. 5. (W31M03V02) Getting started with PowerShell Video

  6. 6. (W31M04) Using PowerShell for Log Analysis

  7. 7. (W31M05) Useful logs in computer forensics

  8. 8. (W31M06) Logs from different channels

  9. 9. (W31M04V03) Using PowerShell for Log Analysis Video

Assessments

Assignment Required

(W31A01) Exercise: Tracking system boot and shutdown phases

Assignment Required

(W31A02) Exercise: Reconstructing recent activity on the computer

Module 4

Module 2

  1. 1. (W31M09) An introduction to the Windows Registry

  2. 2. (W31M10) How the Registry works: Keys and values

  3. 3. (W31M11) The hives

  4. 4. (W31M12) Windows Registry extraction with FTK Imager

  5. 5. (W31M12V04) Windows Registry extraction with FTK Imager Video

  6. 6. (W31M13) Parsing the Registry with FTK Imager

  7. 7. (W31M13V05) Parsing the Registry with FTK Imager Video

  8. 8. (W31M14) Registry parsing with PowerShell: Get-ChildItem and Get-ItemProperty cmdlet

  9. 9. (W31M14V06) Registry parsing with PowerShell: Get-ChildItem and Get-ItemProperty cmdlet Video

  10. 10. (W31M17) Appendix to module 2

Assessments

Assignment Required

(W31A03) Exercise: Registry Key Cell analysis with FTK Imager

Assignment Required

(W31A04) Exercise: Retrieving information with PowerShell

Module 5

Module 3

  1. 1. (W31M18) Registry Analysis with Registry Viewer

  2. 2. (W31M18V07) Registry Analysis with Registry Viewer Video

  3. 3. (W31M19) Machine and Operating System

  4. 4. (W31M19V08) Machine and Operating System Video

  5. 5. (W31M20) USB devices

  6. 6. (W31M20V09) USB devices Video

  7. 7. (W31M21) Users

  8. 8. (W31M21V10) Users Video

  9. 9. (W31M22) Applications

  10. 10. (W31M22V11) Applications Video

  11. 11. (W31M23) Network

  12. 12. (W31M23V12) Network Video

  13. 13. (W31M26) Appendix to module 3

Assessments

Assignment Required

(W31A05) Exercise: Investigating through Registry Analysis

Assignment Required

(W31A06) Exercise: Parsing Registry Keys to collect network information

Module 6

Module 4

  1. 1. (W31M27) Combining PowerShell with Log Parser

  2. 2. (W31M27V13) Combining PowerShell with Log Parser Video

  3. 3. (W31M28) Tracking Remote Desktop Sessions

  4. 4. (W31M29) Tracking Network Connections

  5. 5. (W31M29V14) Tracking Remote Desktop Sessions Video

  6. 6. (W31M30) A practical example - Unauthorized access from a corporate network

  7. 7. (W31M30V15) A practical example – Unauthorized access from a corporate network Video

Assessments

Assignment Required

(W31M31A07) Exercise: Reconstructing a Remote Desktop Session

Assignment Required

(W31M31A08) Exercise: Putting it all together - simulation of a real forensics expertise in a Windows Environment

Quiz Required

(W31Q01) Windows Registry and Log Analysis Final Exam

Course access

Unlock Windows Registry and Log Analysis (W31).

Enter your email. We’ll send a sign-in code here without taking you away from this course.