A hands-on Windows forensics training and certification track focused on identifying and analyzing critical system artifacts through disk, memory, and super timeline analysis. The track develops practical investigation skills through realistic cases involving insider threats, data exfiltration, and artifact correlation.
Analyst II: Practical Windows Forensics teaches you how to investigate real Windows systems using core forensic artifacts, timelines, and evidence-based analysis techniques. You’ll dive deep into user activity, persistence, execution, and attacker behavior through guided hands-on labs. By the end, you’ll be able to reconstruct events, correlate artifacts, and identify malicious activity with confidence.
Includes on-demand course Practical Windows Forensics, four realistic Windows forensic investigation scenarios, and the performance-based PWFA certification exam.