Skip to content
201: Practical Windows Forensics DIY Edition
1) Welcome to Practical Windows Forensics! Sample Lesson
Welcome and course introduction
Resources and materials overview
PWF course roadmap
2) Lab Setup
Lab setup overview
2.1) Setting up your forensic workstation
Build your forensic workstation tutorial and downloads
VirtualBox and Windows 2019 VM installation
WSL and Ubuntu installation on Windows 2019 Server
WSL and Ubuntu installation on Windows 10 (alternative)
Forensic workstation Windows configuration
Downloading and installing forensic tools
2.2) Prepare your target system
Download and install the Windows 10 VM
Target system configuration and attack script preparation
Execute the attack script on the target system
3) Data Collection Process
Forensic process overview
Target system containment
Memory acquisition of the target system
Disk acquisition of the target system
4) Examination of the Forensic Data
Data examination process overview
Mounting the disk image with Arsenal Image Mounter
Overview of Windows files and forensic artifacts
Creating a triage data collection with KAPE
5) Disk Analysis Introduction
Sources of evidence and disk analysis process overview
Notes taking and course materials
5.1) Windows Registry Analysis
Windows registry overview
Exploring the registry with Registry Explorer
Gathering system information with RegRipper
RegRipper analysis continued
Parsing registry hives in bulk with RegRipper
User accounts and SIDs Overview
Analysis of user accounts, groups and profiles
5.2) User Behavior Analysis
User behavior analysis overview
UserAssist analysis
RecentDocs analysis
ShellBags analysis
5.3) Overview of Disk Structures, Partitions and File Systems
What is a file system
Exploring disk structures and the NTFS
5.4) Analysis of the Master File Table (MFT)
Overview of MFT Records
Analysis of MFT Records with MFTECmd
MFT parsing and in-depth analysis with MFTECmd
File timestamps and the MACB timestamp format
Investigating file timestomping
5.5) Finding Evidence of Deleted Files with USN Journal Analysis
How can we find evidence of deleted files?
Analyzing the USN Journal for deleted files
5.6) Analyzing Evidence of Program Execution
Execution artifacts introduction
Analyzing the Background Activity Moderator (BAM)
Analysis of the Application Compatibility Cache (ShimCache)
Overview of the Amcache
Analyzing the Amcache with AmcacheParser
BONUS: Amcache in-depth analysis and why scheduled tasks matter
Windows Prefetch analysis with PECmd
Windows Prefetch timeline analysis
5.7) Finding Evidence of Persistence Mechanisms
Analyzing Windows run keys with Registry Explorer and RegRipper
How to find evidence of persistence in startup folders
Windows Services overview and analysis
Detecting and analyzing malicious scheduled tasks
Persistence mechanisms analysis with Sysinternals Autoruns
5.8) Uncover Malicious Activity with Windows Event Log Analysis
Windows event logs overview
Analyzing Windows event logs with EventLogExplorer and EvtxECmd
Windows Defender event log analysis
Analyzing service installs using the System event log
Security event log and authentication events
Authentication events and logon IDs
PowerShell event logs overview
Analyzing malicious PowerShell events
Overview of the Sysmon event log and relevant event IDs
Detecting malicious events in Sysmon event logs
6) Windows Memory Analysis
Setting up Volatility3 in the Ubuntu environment
Important files for memory analysis
Gathering Windows system information with Volatility3
Detecting suspicious Windows processes
Dumping processes from the memory
Detecting and analyzing injected DLLs
Identifying process owners and associated SIDs
Detecting and analyzing malicious registry key entries from memory
7) Kitchen-Sink Analysis with Super Timelines
Super timeline analysis process and important requirements
Preparing tools and converting the disk image with QEMU
Memory timeline creation with Volatility3
Creating a timeline of the disk image with Plaso tools and Log2Timeline
Merging timelines with mactime parser and creating a Super Timeline
Super Timeline overview with Timeline Explorer
Analyzing malicious activity using the Super Timeline
8) Reporting
Considerations and reporting types
9) Final!
Wrap up and next steps
Previous Topic
Next Lesson

PWF course roadmap

  1. 201: Practical Windows Forensics DIY Edition
  2. 1) Welcome to Practical Windows Forensics!
  3. PWF course roadmap
Previous Topic
Back to Lesson
Next Lesson
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
  • Manage options
  • Manage services
  • Manage {vendor_count} vendors
  • Read more about these purposes
Preferences
  • {title}
  • {title}
  • {title}
Scroll to Top

Training Waitlist

Join our waitlist and get notified when training becomes available.

Contact Information
Professional Experience
I'm interested in

*By submitting this form, you’re agreeing that we will contact you and to receive our free email newsletter. (You’ll never be spammed and you can unsubscribe at any time.) We do not share your information with third-parties.