Home
>
Courses
>
Windows Forensics
Course

Windows Forensics

The Windows Forensics course teaches the techniques and tools to investigate and analyze digital evidence within Windows systems. It covers exploiting techniques and tools, storage, memory, registry, and log analysis. By the end of the course, students will be proficient in performing comprehensive forensic investigations and constructing detailed timelines of system events.

Hours
40 Academic Hours
Format
Online
Duration
4 Weeks

LIVE, instructor-led training

Learnign Outcomes

Target Audience

This program is designed for IT professionals, cybersecurity analysts, digital forensics investigators, incident responders, and system administrators with a foundational understanding of IT systems, Windows operating systems, cybersecurity fundamentals, and forensic investigation techniques.

The ideal participants are those looking to deepen their expertise in forensic analysis, specifically in Windows environments. This course is precious for individuals in roles that involve investigating security incidents, recovering and analyzing digital evidence, or auditing Windows-based systems for potential breaches. It is well-suited for professionals working in mid to largesized organizations who are responsible for ensuring the integrity and security of Windows infrastructure and need to enhance their ability to uncover and respond to malicious activities within these systems.

GCC’s Training for CompTIA’s certifications

GCC, in collaboration with CYBERPROAI, a leading global tech training provider, is offering top-tier training for CompTIA’s Network+ and Security+ certifications, two of the most recognized credentials in the IT industry.CompTIA certifications are globally respected and vendor neutral. They validate critical skills required for various IT and cybersecurity roles. They serve as a benchmark for technical proficiency, helping professionals enhance their credibility, expand career opportunities, and increase earning potential. Many organizations, including governments and Fortune 500 companies, recognize CompTIA certifications as a hiring and career advancement standard.

Required Prior Knowledge

• PowerShell

• Windows System

Learning Methods

Computing Requirements

• CPU: Intel i5/i7 or AMD 5x/7x

• RAM: 16GB

• HDD: 300GB available space

Introduction to Windows

  • A brief History of Windows
  • Sorting Out the Different Versions and Editions
  • Windows into the Future
  • Digital Forensics in a Rapidly Changing Space

Triage Acquisiton and Analysis

  • Rapid Assesment of Windows Behavior
  • Rapid Acquisition of Artifacts
  • Windows Incident Response

Windows File System

  • TFS Internals and the Master File Table (MFT)
  • The File Allocation Table (FAT12/16/32/exFAT)
  • Generating Filesystem Timeline Scanning

Disk Image Acquisition

  • Image Acquisition Tools for Windows
  • Remote Image Acquisition
  • Master File Table (MFT) Repair

File Carving in NTFS and FAT

  • Understanding Cluster Chains
  • Understanding Alternate Data Stream (ADS)
  • The Sleuth Kit (TSK) on Windows
  • Using Autopsy

Memory Acquisition

  • Exploring Various Tools for Windows RAM Acquisition
  • Remote RAM Image Acquisition

Memory Analysis

  • Using Volatility with Windows
  • Using Mandiant’s Redline

Windows event logs (EVTX)

  • Application, security and system logs
  • Other Service Logs
  • Log Processing and Analysis with PowerShell

Registry Analysis

  • Registry file Acquisition
  • Using FTK Imager
  • Registry Structure

Active Directory Infrastructure

  • Prominent Security Features in AD
  • Well Known Weaknesses in AD
  • Windows AD Authentication and Kerberos

Active Directory Infrastructure

  • Sources of Information
  • Application, Systema and Security Logs
  • Other Logs
  • Using Log2TimeLine

Enroll

$ 4200*

$ 5400

* Special Launch Pricing - Act Fast
Enroll