Current Status
Not Enrolled
Enroll in this course to get access
Price
Closed
Get Started
This course is included in the Analyst I – PWFA Training Track and Hero Bundle Training. Enroll to access the course.
> View Course Syllabus
Support & FAQs
Please use our Support & FAQ page to find more information and reach out to us and join our Discord community for general conversation topics and networking.
Important: Virtual Labs
- Your labs are real virtual machines in the cloud. This means it may take a few minutes until they are started up and available.
- Whenever you have less than 15 minutes remaining, you will have the option to extend your lab by 1 hour.
- When a VM shuts down, it will not store your files and data.
- For the best experience, it’s recommended to use Google Chrome where you will have copy and paste functionality.
Tools Used
Arsenal Image Mounter, Kroll Artifact Browser (KAPE), Eric Zimmerman Tools (Timeline Explorer, Registry Explorer, MFTECmd, AppCompatCacheParser, AmcacheParser, PECmd, EvtxECmd), Event Log Explorer, RegRipper, Sysinternals Autoruns, Sysmon, Volatility3, QEMU, Plaso Tools, Log2Timeline
Certificate of Completion
Once you finish the course you will receive your Certificate of Completion!
Average Review Score:
★★★★★
You must log in and have started this course to submit a review.
Course Content
2) Online Lab Instructions
1 Topic
You don't currently have access to this content
3) Data Collection Process
3 Topics
You don't currently have access to this content
Lesson Content
0% Complete
0/3 Steps
4) Examination of the Forensic Data
5 Topics
You don't currently have access to this content
5) Disk Analysis Introduction
2 Topics
You don't currently have access to this content
Lesson Content
0% Complete
0/2 Steps
5.1) Windows Registry Analysis
7 Topics
You don't currently have access to this content
Lesson Content
0% Complete
0/7 Steps
5.2) User Behavior Analysis
4 Topics
You don't currently have access to this content
Lesson Content
0% Complete
0/4 Steps
5.3) Overview of Disk Structures, Partitions and File Systems
2 Topics
You don't currently have access to this content
5.4) Analysis of the Master File Table (MFT)
5 Topics
You don't currently have access to this content
5.5) Finding Evidence of Deleted Files with USN Journal Analysis
2 Topics
You don't currently have access to this content
Lesson Content
0% Complete
0/2 Steps
5.6) Analyzing Evidence of Program Execution
8 Topics
You don't currently have access to this content
Lesson Content
0% Complete
0/8 Steps
5.7) Finding Evidence of Persistence Mechanisms
5 Topics
You don't currently have access to this content
Lesson Content
0% Complete
0/5 Steps
5.8) Uncover Malicious Activity with Windows Event Log Analysis
10 Topics
You don't currently have access to this content
Lesson Content
0% Complete
0/10 Steps
6) Windows Memory Analysis
8 Topics
You don't currently have access to this content
Lesson Content
0% Complete
0/8 Steps
7) Kitchen-Sink Analysis with Super Timelines
3 Topics
You don't currently have access to this content
8) Reporting
1 Topic
You don't currently have access to this content
9) Final!
1 Topic
You don't currently have access to this content
It is essential to learn about cybersecurity continuously. The PWF course is an invaluable resource for this purpose. Markus shares his expertise and always responds on Discord when you contact him. Throughout the course, you will be guided through an investigation and learn various techniques. Markus presents his framework for a Digital Forensics and Incident Response (DFIR) investigation. I highly recommend this course.