This advanced three-day course will familiarize the student with the many artifacts left behind on a Windows NT platform. Operating systems analyzed include Windows XP, Windows Vista, Windows 7, and Windows 8/10.
This course focuses on the traditional artifacts associated with normal operating system functions and user interactions. Detailed discussions focusing on operating system processes will lead to analysis of the artifacts left behind after normal user / system interaction.
This course is designed to advance the skill set of forensic examiners by focusing on operating system artifacts analysis and forensic processing.
Completing this course will enable forensic examiners to:
This hands-on course is geared toward forensic investigators with at least six (6) months experience in forensic casework and with a basic understanding of Microsoft data structures.
Students should meet or exceed the following:
The course will follow adult learning principles through training aids, presentations, diagrams, and instructor led practical exercises. Each artifact covered will be presented in either one or two 50 minute sessions followed by review questions. Students will be given the opportunity throughout the course to ask questions and discuss objectives covered in more detail. At the conclusion of the course day each student will complete practical exercises that reinforce topics taught during that day's training.
The course is structured as follows:
Introduction and Tools Used During Training
Windows NT Versions and Key Features
As with most operating system upgrades, Microsoft has always incorporated features and functions from previous verions of Windows. In this module students will compare the features of XP, Vista, and Windows 7/8/10 including the differences between Home, Media, Professional, and Ultimate editions
Windows Directory Structures
Partition Tables and GUID Partition Tables
Windows 7/8/10 - Windows Libraries
Recycle Bin Functionality Across NT Systems
Link Files and Jump Files
User Account Control and Internet Explorer Key Artifacts
Thumbs.db vs. ThumbesCache
Windows Event Logs
Prefetch and Superfetch
Volume Shadow Copy
No classes scheduled at this time.