7 Days Left to Save $400 for SANS Security West 2010 >> More Info

The most trusted source for computer security training, certification and research.

select a course
Global Information Assurance Certification

Opened my eyes to things that I thought I already knew, and I'm already learning new material on day 1
-Anthony Fischer, Front Porch, Inc.

SECURITY 441

Windows Forensics

6 CPE Credits per day

Investigations involving Windows-based operating systems occur every day. As a result, it is essential for an investigator to know how to properly examine the critical files and structures of the Windows operating system. This two-day course will provide an in-depth study and examination of the forensic evidence left on the VISTA, Windows XP, and Windows server based operating systems. This hands-on forensic course will arm you with methods and techniques to investigate critical areas of the Windows operating system for any case.

Beginning with the registry, the new investigator will learn how to discover critical user and system information from the Windows Registry that is pertinent to any investigation. Second, the investigator will learn how to find and examine logs from a Windows machine in order to find relevant data to any case. In the final part of the day, the investigator will learn how to examine and search email for key evidence. Throughout the day, the investigator will utilize their skills in real hands-on cases exploring evidence and artifacts discussed throughout the day.

  • Topics
    • Registry Forensics
      • Registry Basics
      • Core System Information
        • System Name and Version
        • Configuration (Domain, Workgroup)
        • Networks
        • Drives
        • USB Drives
        • User Information
        • Group Information
        • Install Date
        • Timezone
    • User Forensic Data
        • User searches
        • Typed URLS
        • Recently Modified Documents
    • Event Log Forensics
      • Event Logging Basics
      • Locations
      • Viewers
      • Event Types
    • Email Forensics
      • How Email Works
      • Locations
      • Examination
      • Types of Email Formats
      • Email Analysis
      • Email Searching and Examination
  • Day 1 Exercises
    • Profile a computer system using evidence found in the registry
    • Profile a user’s activities using evidence found in the registry
    • Find event log evidence of user logins and odd system activity in the event logs
    • Find email evidence containing a specific set of keywords
    • Find email evidence sent to a specific email address

This instructor had an impressive, solid background and does an excellent job presenting the material in a way that geek wannabes can understand
-Julie Stroud, U.S. Department of Energy

Training Events By Course