Windows Artifacts Foundations24 Hours / 3-Day
Be introduced to the many forensically relevant items stored on a Windows-based system through user interaction and host operating system functionality.
Operating Systems Overview
- Learn to identify the core features of each NT Operating System
- List the key artifacts contained on modern systems
- Identify and review common folders on
a NTOperating System.
Windows® System Artifacts
- Describe the purpose of User Account Control
- Discuss the forensic importance of Windows Prefetch and Superfetch
- Learn how to examine ShadowCopies
- Examine the function and forensic importance of the Recycle Bin.
Introduction to the Windows® Registry
- Define the Windows Registry
- Discuss Forensic benefits of examining the Registry
- Recovering evidentially relevant data from the following registry files:
- Introduction to Windows Shortcuts
- Examine Link File Anatomy
- Introduction to Jump Lists and analysis.
- Learn of the functions Windows uses to cache thumbnail images
- Discuss user interaction characteristics
- Examine the internal structure of each cached database.
Windows® Start Screen Examination
- Describe the purpose of Windows Immersive Applications
- Examine how the Live Tiles database functions
- Explore the storage areas for Immersive Applications.
- Gain an overview of Internet Explorer
- Discuss Legacy Features
- Examination of data storage locations and artifacts of forensic interest
- Introduction to Microsoft Edge
- Examine storage locations
- Learn of travel logs and their examination
- Discuss the implications of InPrivate browsing
- Introduction to ESE Database analysis
- Overview of Cortana digital assistant
- Examine cached data from user interaction.
- 24hrs of Instruction
- Course Manual
- Practical Files
- Attendance Certificate
To get the most out of this class, you should:
- Have 6 months experience of forensic examinations
- Be familiar with Windows Operating systems.
Download the Syllabus
Download a printable copy of the course description and key learning points.
If you are interested in hosting this, or any of our courses at your facility, contact us.