!!IMPORTANT - BRING YOUR OWN SYSTEM CONFIGURED USING THESE DIRECTIONS!!

A properly configured system is required for each student participating in this course. Before coming to class, carefully read and follow these instructions exactly.

You can use any 64-bit version of Windows, Mac OSX, or Linux as your core operating system that also can install and run VMware virtualization products. You also must have a minimum of 8 GB of RAM or higher for the VM to function properly in the class.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows and Linux that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.

Please download and install VMware Workstation 12, VMware Fusion 8, or VMware Player 12 or higher versions on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.

MANDATORY FOR500 SYSTEM HARDWARE REQUIREMENTS:

• CPU: 64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)
• 8 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 8 GB of RAM or higher of RAM is mandatory and minimum. For best experience 16GB of RAM is recommended.)
• Wireless 802.11 Capability
• USB 3.0
• 250+ Gigabyte Host System Hard Drive minimum
• 200 Gigabytes of Free Space on your System Hard Drive - Free Space on Hard Drive is critical to host the VMs we distribute
• Students must have the capability to have Local Administrator Access within their host operating system and BIOS settings

MANDATORY FOR500 SYSTEM SOFTWARE REQUIREMENTS:

Host Operating System: Fully patched & updated Windows (7+), Mac OSX (10.10+), or a recent version of Linux operating system (released 2016 or later) that also can install and run VMware virtualization products (VMware Workstation, VMware Fusion, or VMware Player). Please note: It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices. Those who use a Linux host must also be able to access ExFAT partitions using the appropriate kernel or FUSE modules.

PLEASE INSTALL THE FOLLOWING SOFTWARE PRIOR TO CLASS:

1. Microsoft Office (any version) w/Excel or OpenOffice w/Calc installed on your host - Note you can download Office Trial Software online (free for 30 days)
2. Install VMware Workstation 12, VMware Fusion 8, or VMware Player 12 (more recent versions are also ok)
3. Download and install 7Zip on your host

IN SUMMARY, BEFORE YOU BEGIN THE COURSE YOU SHOULD:

1. Bring the proper system hardware (64bit/8GB Ram) and operating system configuration
2. Install VMware (Workstation, Player, or Fusion), MS Office, and 7zip and make sure it works before class.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

• Information security professionals who want to learn the in-depth concepts of Windows digital forensics investigations
• Incident response team members who need to use deep-dive digital forensics to help solve their Windows data breach and intrusion cases and perform damage assessments
• Law enforcement officers, federal agents, and detectives who want to become deep subject-matter experts on digital forensics for Windows-based operating systems
• Media exploitation analysts who need to master tactical exploitation and Document and Media Exploitation (DOMEX)
• Anyone interested in a deep understanding of Windows forensics who has a background in information systems, information security, and computers

Use this sample training request letter, or elements of it, to justify the time and budget required to complete SANS training to your manager. Simply copy and paste text into an email to your manager, then make any necessary adjustments to personalize the information.

FOR500: Windows Forensic Analysis focuses on in-depth analysis of the Microsoft Windows Operating System and artifacts. There are no prerequisite courses required to take this course. The artifacts and tool-agnostic techniques you will learn will lead to the successful analysis of any cyber incident and crime involving a Windows Operating System. Please note that this is an analysis-focused course; FOR500 does not cover the basics of evidentiary handling, the "chain of custody," or introductory drive acquisition. Our authors update FOR500 aggressively to stay current with the latest artifacts and techniques discovered. This course is perfect for you if you are interested in in-depth and current Microsoft Windows Operating System forensics and analysis for any incident that occurs. If you have not updated your Windows forensic analysis skills in the past three years or more, this course is essential.

• Windows 10 Enterprise version of the SIFT Workstation Virtual Machine with over 200 commercial, open-source, and freeware Digital Forensics and Incident Response tools prebuilt into the environment
• Full version licenses for 120 days:
• Magnet Forensics Internet Evidence Finder and Axiom
• TZWorks Toolset
• USB Detective
• Two 64 GB USB keys with real-world cases to examine during and after class
• FOR500 detailed exercise workbook nearly 500 pages in length with detailed step-by-step instructions
• MP3 audio files of the complete course lecture
• Complete course lecture

• Perform proper Windows forensic analysis by applying key techniques focusing on Windows 7, Windows 8/8.1, and Windows10
• Use full-scale forensic tools and analysis methods to detail nearly every action a suspect accomplished on a Windows system, including who placed an artifact on the system and how, program execution, file/folder opening, geo-location, browser history, profile USB device usage, and more
• Uncover the exact time that a specific user last executed a program through Registry and Windows artifact analysis, and understand how this information can be used to prove intent in cases such as intellectual property theft, hacker-breached systems, and traditional crimes
• Determine the number of times files have been opened by a suspect through browser forensics, shortcut file analysis (LNK), email analysis, and Windows Registry parsing
• Audit cloud storage usage, including detailed user activity, identifying deleted files, and even documenting files available only in the cloud
• Identify keywords searched by a specific user on a Windows system to pinpoint the data and information that the suspect was interested in finding and accomplish detailed damage assessments
• Use Windows Shellbag analysis tools to articulate every folder and directory that a user or attacker opened up while browsing local, removable, and network drives
• Determine each time a unique and specific USB device was attached to the Windows system, the files and folders that were accessed on it, and who plugged it in by parsing Windows artifacts such as the Registry and Event Log files
• Learn Event Log analysis techniques and use them to determine when and how users logged into a Windows system, whether via a remote session, at the keyboard, or simply by unlocking a screensaver
• Determine where a crime was committed using Registry data to pinpoint the geo-location of a system by examining connected networks and wireless access points
• Use browser forensic tools to perform detailed web browser analysis, parse raw SQLite and ESE databases, and leverage session recovery artifacts database carving to identify the web activity of suspects, even if privacy cleaners and in-private browsing are used
• Specifically determine how individuals used a system, who they communicated with, and files that were downloaded, modified, and deleted

Course Review: SANS FOR500 Windows Forensic Analysis

Course and GIAC Cert Review

"The SANS Institute is currently the leader in the commercial IR and computer forensic training market. They have a large number of quality courses." - From Incident Response & Computer Forensics, Third Edition (July 2014), by Jason Luttgens, Matthew Pepe, Matthew, and Kevin Mandia

"This is a very high-intensity course with extremely current course material that is not available anywhere else in my experience." - Alexander Applegate, Auburn University

"Best forensics class I have had yet (and pretty much the only one that gives you some sort of framework on HOW to attack an exam)." - Det. Juan C. Marquez, Prince William County, Virginia Police Department

"Hands down the BEST forensics class EVER!! Blew my mind at least once a day for 6 days!" - Jason J., Federal Government, Military

"I took SANS FOR500 Windows Forensics and the learning opportunity was second to none. Anyone looking for a first-rate forensics class that they can immediately take back to the real world and apply to their job needs to take at least one class from SANS in their lifetime. Whatever the cost may be to you, if forensics is a career priority for you, then you need to take at least one forensics class from SANS." - Chris Nowell, Information Security Architect, Airlines Reporting Corporation

"As a member of the IR team, this course will aid in investing compromised hosts." - Mike Piclher, URS Corp.

"FOR500 is based on real scenarios that are likely to occur again. The most up-to-date training I have received." - Martin Heyde, UK Ministry of Defence

"Best forensics course I have taken to date. Vast amounts of information." - Ellen C., Federal Government, Agency

"Call me a geek, but this is FUN!" - Frank Dixon, Babcock & Wilcox Company

"Overall the course continues to be chock full of megalicious forensicness. Thanks a bunch for the key knowledge." - Vincent Bryant, Blue Cross Blue Shield of Tennessee

"If you were not interested in forensics before, you will be after this class. For those who already love it, it is reassurance that you are doing the right thing with your life." - Cleora Madison, Walt Disney Theme Parks and Resorts

"The Registry labs are invaluable. I learned more in this class about registry than in 10 years at work. Thanks!" - Michael Mimo, JP Morgan

"I was really looking forward to Windows in-depth and that is exactly what we are getting!" - Joshua Hoover, Charles Schwab

"I have been using forensics tools for years. I never professed to know it all; however, I did not expect to learn as much as I did." - Jody Hawkins, Cook Children's Health Care System

"I really appreciate the prebuilt and configured SIFT workstation. The FOR500 class materials and instruction were outstanding." - Clint Modesitt, LSUHSC

"FOR500 is absolutely necessary for any computer forensic type career. Excellent information!" - Rebecca P., Federal Government, Agency

"This course was by far the most informative and well taught class I have attended." - Brian Periera, Farfield Police Department

"Love the amount of detail/info in books, love the VM." - Jeff Datzman, Vacaville Police Department

"Best course I have taken in 20 years." - Gary Sanders, Louisiana Workers' Compensation Corporation

"The hands-on labs are excellent - best I have had in 15 years of forensics classes. The best books as well." - Shawn Bostick, Arkansas Attorney General's Office

"This is by far the best training I have ever had. My forensic knowledge increased more in the last five days than in the last year." - Vito Rocco, University of Nevada, Las Vegas

"Are you kidding me? I, personally, see this course (FOR500) as pretty much perfected." - Mike Bowden, Boeing

"There's not a lot of courses that cover depth as well as the width of material. I think FOR500 strikes the right balance between the two." - Wayne Dawson, Vancity Savings Credit Union