Skip to content
Practical Windows Forensics
1) Welcome to Practical Windows Forensics! Sample Lesson
Welcome and course introduction
PWF course roadmap
2) Online Lab Instructions
Lab Instructions and Overview
3) Data Collection Process
Forensic process overview
Data collection options
Target system data collection
4) Examination of the Forensic Data
Lab Instructions – Windows Forensic VM
Data examination process overview
Mounting the disk image with Arsenal Image Mounter
Overview of Windows files and forensic artifacts
Creating a triage data collection with KAPE
5) Disk Analysis Introduction
Sources of evidence and disk analysis process overview
Notes taking and course materials
5.1) Windows Registry Analysis
Windows registry overview
Exploring the registry with Registry Explorer
Gathering system information with RegRipper
RegRipper analysis continued
Parsing registry hives in bulk with RegRipper
User accounts and SIDs Overview
Analysis of user accounts, groups and profiles
5.2) User Behavior Analysis
User behavior analysis overview
UserAssist analysis
RecentDocs analysis
ShellBags analysis
5.3) Overview of Disk Structures, Partitions and File Systems
What is a file system
Exploring disk structures and the NTFS
5.4) Analysis of the Master File Table (MFT)
Overview of MFT Records
Analysis of MFT Records with MFTECmd
MFT parsing and in-depth analysis with MFTECmd
File timestamps and the MACB timestamp format
Investigating file timestomping
5.5) Finding Evidence of Deleted Files with USN Journal Analysis
How can we find evidence of deleted files?
Analyzing the USN Journal for deleted files
5.6) Analyzing Evidence of Program Execution
Execution artifacts introduction
Analyzing the Background Activity Moderator (BAM)
Analysis of the Application Compatibility Cache (ShimCache)
Overview of the Amcache
Analyzing the Amcache with AmcacheParser
BONUS: Amcache in-depth analysis and why scheduled tasks matter
Windows Prefetch analysis with PECmd
Windows Prefetch timeline analysis
5.7) Finding Evidence of Persistence Mechanisms
Analyzing Windows run keys with Registry Explorer and RegRipper
How to find evidence of persistence in startup folders
Windows Services overview and analysis
Detecting and analyzing malicious scheduled tasks
Persistence mechanisms analysis with Sysinternals Autoruns
5.8) Uncover Malicious Activity with Windows Event Log Analysis
Windows event logs overview
Analyzing Windows event logs with EventLogExplorer and EvtxECmd
Windows Defender event log analysis
Analyzing service installs using the System event log
Security event log and authentication events
Authentication events and logon IDs
PowerShell event logs overview
Analyzing malicious PowerShell events
Overview of the Sysmon event log and relevant event IDs
Detecting malicious events in Sysmon event logs
6) Windows Memory Analysis
Important files for memory analysis
Lab instructions – Linux Forensic VM
Gathering Windows system information with Volatility3
Detecting suspicious Windows processes
Dumping processes from the memory
Detecting and analyzing injected DLLs
Identifying process owners and associated SIDs
Detecting and analyzing malicious registry key entries from memory
7) Kitchen-Sink Analysis with Super Timelines
Super timeline analysis process and important requirements
Super Timeline overview with Timeline Explorer
Analyzing malicious activity using the Super Timeline
8) Reporting
Considerations and reporting types
9) Final!
Wrap up and next steps
Next Topic

1) Welcome to Practical Windows Forensics!

  1. Practical Windows Forensics
  2. 1) Welcome to Practical Windows Forensics!
Lesson Content
0% Complete 0/2 Steps
Welcome and course introduction
PWF course roadmap
Back to Course
Next Topic
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
  • Manage options
  • Manage services
  • Manage {vendor_count} vendors
  • Read more about these purposes
Preferences
  • {title}
  • {title}
  • {title}
Scroll to Top

Training Waitlist

Join our waitlist and get notified when training becomes available.

Contact Information
Professional Experience
I'm interested in

*By submitting this form, you’re agreeing that we will contact you and to receive our free email newsletter. (You’ll never be spammed and you can unsubscribe at any time.) We do not share your information with third-parties.