FOR500 - Windows Forensic Analysis

Every organization must be fully equipped against cybercrime occurring on computer systems and within corporate networks. Government agencies increasingly require trained media exploitation specialists to recover vital intelligence from Windows systems, as well as law enforcement investigators to get to the root of a crime.
 

This FOR500: Windows Forensic Analysis provides an in-depth and comprehensive digital forensics knowledge of Microsoft Windows operating systems by analyzing and authenticating forensic data, as well as tracking detailed user activity and organizing findings. This will allow participants to apply digital forensic methodologies to a variety of case types and situations, allowing them to apply in the real world the right methodology to achieve the best outcome.

• Conduct proper Windows forensic analysis by applying key techniques focusing on Windows 7, Windows 8/8.1, and Windows 10
• Identify and use forensic tools and analysis methods to detail nearly every action a suspect accomplished on a Windows system, including who placed an artifact on the system and how, program execution, file/folder opening, geolocation, browser history, profile USB device usage, cloud storage usage, and more
• Know the number of times files have been opened by a suspect through browser forensics, shortcut file analysis (LNK), email analysis, and Windows Registry parsing
• Identify keywords searched by a specific user on a Windows system to pinpoint the data and information that the suspect was interested in finding, and accomplish detailed damage assessments
• Discover the exact time that a specific user last executed a program through Registry and Windows artifact analysis, and understand how this information can be used to prove intent in cases such as intellectual property theft, hacker-breached systems, and traditional crimes
• Audit cloud storage usage, including detailed user activity, identifying deleted files, and even documenting files available only in the cloud
• Use Windows Shellbag analysis tools to articulate every folder and directory a user or attacker interacted with while accessing local, removable, and network drives
• Determine each time a unique and specific USB device was attached to the Windows system, the files and folders accessed on it, and what user plugged it in by parsing Windows artifacts such as Registry hives and Event Log files
• Specifically determine how individuals used a system, who they communicated with, and files that were downloaded, modified, and deleted
• Use Event Log analysis techniques in determining when and how users logged into a Windows system, whether via a remote session, at the keyboard, or simply by unlocking a screensaver
• Determine where a crime was committed using Registry data and pinpoint the geolocation of a system by examining connected networks and wireless access points
• Use browser forensic tools to perform detailed web browser analysis, parse raw SQLite and ESE databases, and leverage session recovery artifacts to identify web activity, even if privacy cleaners and in-private browsing software are used