The most trusted source for computer security training, certification and research.

select a course
San Francisco, CA - April 19 - 21, 2009
Global Information Assurance Certification

The SANS class stands out above the rest because of the subject matter experts who teach the classes and labs.
-Shirlee Eitel-Birgham, State of Nevada

SECURITY 441

Windows Forensics

Sunday, April 19, 2009 - Monday, April 20, 2009
Rob Lee, SANS Faculty Fellow
6 CPE Credits per day

Investigations involving Windows-based operating systems occur every day. As a result, it is essential for an investigator to know how to properly examine the critical files and structures of the Windows operating system. This two-day course will provide an in-depth study and examination of the forensic evidence left on the VISTA, Windows XP, and Windows server based operating systems. This hands-on forensic course will arm you with methods and techniques to investigate critical areas of the Windows operating system for any case.

Beginning with the registry, the new investigator will learn how to discover critical user and system information from the Windows Registry that is pertinent to any investigation. Second, the investigator will learn how to find and examine logs from a Windows machine in order to find relevant data to any case. In the final part of the day, the investigator will learn how to examine and search email for key evidence. Throughout the day, the investigator will utilize their skills in real hands-on cases exploring evidence and artifacts discussed throughout the day.

  • Topics
    • Registry Forensics
      • Registry Basics
      • Core System Information
        • System Name and Version
        • Configuration (Domain, Workgroup)
        • Networks
        • Drives
        • USB Drives
        • User Information
        • Group Information
        • Install Date
        • Timezone
    • User Forensic Data
        • User searches
        • Typed URLS
        • Recently Modified Documents
    • Event Log Forensics
      • Event Logging Basics
      • Locations
      • Viewers
      • Event Types
    • Email Forensics
      • How Email Works
      • Locations
      • Examination
      • Types of Email Formats
      • Email Analysis
      • Email Searching and Examination
  • Day 1 Exercises
    • Profile a computer system using evidence found in the registry
    • Profile a user’s activities using evidence found in the registry
    • Find event log evidence of user logins and odd system activity in the event logs
    • Find email evidence containing a specific set of keywords
    • Find email evidence sent to a specific email address

I learned more here in six days than I could in a year in terms of breadth of knowledge.
-Stephen Yuhas, TESSCO Technologies