London November 2019

A properly configured system is required to fully participate in this course. These requirements are the mandatory minimums. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

This is common sense, but we will say it anyway. Back up your system before class. Better yet, do not have any sensitive data stored on the system. SANS can't be responsible for your system or data.

MANDATORY FOR500 SYSTEM HARDWARE REQUIREMENTS:

• CPU: 64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)
• It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.

• BIOS settings must be set to enable virtualization technology, such as "Intel-VT".

  Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it!

• 16 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.)
• USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. (A Type-C to Type-A adapter may be necessary for newer laptops.) (Note: Some endpoint protection software prevents the use of USB devices - test your system with a USB drive before class to ensure you can load the course data.)
• 200 Gigabytes of Free Space on your System Hard Drive - Free Space on Hard Drive is critical to host the VMs we distribute
• Local Administrator Access is required. This is absolutely required. Don't let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
• Wireless 802.11 Capability

MANDATORY FOR500 SYSTEM SOFTWARE REQUIREMENTS:

• Host Operating System: Your system must be running either Windows 10 Pro or higher or macOS 10.12 or later that also can install and run VMware virtualization products (VMware Workstation 14, VMware Fusion 10, or VMware Player 14)
• Please note: It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.

PLEASE INSTALL THE FOLLOWING SOFTWARE PRIOR TO CLASS:

1. Download and install VMware Workstation 14, VMware Fusion 10, or VMware Player 14 or higher versions on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.
2. Download and isntall 7Zip (for Windows Hosts) or Keka (macOS).

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

• Information security professionals who want to learn the in-depth concepts of Windows digital forensics investigations
• Incident response team members who need to use deep-dive digital forensics to help solve their Windows data breach and intrusion cases and perform damage assessments
• Law enforcement officers, federal agents, and detectives who want to become deep subject-matter experts on digital forensics for Windows-based operating systems
• Media exploitation analysts who need to master tactical exploitation and Document and Media Exploitation (DOMEX)
• Anyone interested in a deep understanding of Windows forensics who has a background in information systems, information security, and computers

Use this sample training request letter, or elements of it, to justify the time and budget required to complete SANS training to your manager. Simply copy and paste text into an email to your manager, then make any necessary adjustments to personalize the information.

FOR500: Windows Forensic Analysis focuses on in-depth analysis of the Microsoft Windows Operating System and artifacts. There are no prerequisite courses required to take this course. The artifacts and tool-agnostic techniques you will learn will lead to the successful analysis of any cyber incident and crime involving a Windows Operating System. Please note that this is an analysis-focused course; FOR500 does not cover the basics of evidentiary handling, the "chain of custody," or introductory drive acquisition. Our authors update FOR500 aggressively to stay current with the latest artifacts and techniques discovered. This course is perfect for you if you are interested in in-depth and current Microsoft Windows Operating System forensics and analysis for any incident that occurs. If you have not updated your Windows forensic analysis skills in the past three years or more, this course is essential.

• Windows 10 Enterprise version of the SIFT Workstation Virtual Machine with over 200 commercial, open-source, and freeware Digital Forensics and Incident Response tools prebuilt into the environment

• Full version licenses for 90 days:

  • Magnet Forensics Internet Evidence Finder and Axiom
  • TZWorks Toolset
• Two 64 GB USB keys with real-world cases to examine during and after class
• FOR500 detailed exercise workbook nearly 500 pages in length with detailed step-by-step instructions

• MP3 audio files of the complete course lecture

• Perform proper Windows forensic analysis by applying key techniques focusing on Windows 7, Windows 8/8.1, and Windows10
• Use full-scale forensic tools and analysis methods to detail nearly every action a suspect accomplished on a Windows system, including who placed an artifact on the system and how, program execution, file/folder opening, geo-location, browser history, profile USB device usage, and more
• Uncover the exact time that a specific user last executed a program through Registry and Windows artifact analysis, and understand how this information can be used to prove intent in cases such as intellectual property theft, hacker-breached systems, and traditional crimes
• Determine the number of times files have been opened by a suspect through browser forensics, shortcut file analysis (LNK), email analysis, and Windows Registry parsing
• Identify keywords searched by a specific user on a Windows system to pinpoint the data and information that the suspect was interested in finding and accomplish detailed damage assessments
• Use Windows Shellbag analysis tools to articulate every folder and directory that a user or attacker opened up while browsing local, removable, and network drives
• Determine each time a unique and specific USB device was attached to the Windows system, the files and folders that were accessed on it, and who plugged it in by parsing Windows artifacts such as the Registry and Event Log files
• Learn Event Log analysis techniques and use them to determine when and how users logged into a Windows system, whether via a remote session, at the keyboard, or simply by unlocking a screensaver
• Determine where a crime was committed using Registry data to pinpoint the geo-location of a system by examining connected networks and wireless access points
• Use browser forensic tools to perform detailed web browser analysis, parse raw SQLite and ESE databases, and leverage session recovery artifacts database carving to identify the web activity of suspects, even if privacy cleaners and in-private browsing are used
• Specifically determine how individuals used a system, who they communicated with, and files that were downloaded, modified, and deleted

Course Review: SANS FOR500 Windows Forensic Analysis http://www.ethicalhacker.net/content/view/459/24/

Course and GIAC Cert Review: http://www.hecfblog.com/search?q=for500

"The SANS Institute is currently the leader in the commercial IR and computer forensic training market. They have a large number of quality courses." -From Incident Response & Computer Forensics, Third Edition (July 2014), by Jason Luttgens, Matthew Pepe, Matthew, and Kevin Mandia

"This is a very high-intensity course with extremely current course material that is not available anywhere else in my experience." -Aexander Applegate, Auburn University

"Best forensics class I have had yet (and pretty much the only one that gives you some sort of framework on HOW to attack an exam)." -Det. Juan C. Marquez, Prince William County, Virginia Police Department

"Hands down the BEST forensics class EVER!! Blew my mind at least once a day for 6 days!" -Jason Jones, U.S. Air Force

"I took SANS FOR500 Windows Forensics and the learning opportunity was second to none. Anyone looking for a first-rate forensics class that they can immediately take back to the real world and apply to their job needs to take at least one class from SANS in their lifetime. Whatever the cost may be to you, if forensics is a career priority for you, then you need to take at least one forensics class from SANS." -Chris Nowell, Information Security Architect, Airlines Reporting Corporation

"As a member of the IR team, this course will aid in investing compromised hosts." - Mike Piclher, URS Corp.

"FOR500 is based on real scenarios that are likely to occur again. The most up-to-date training I have received." - Martin Heyde, UK Ministry of Defence

"Best forensics course I have taken to date. Vast amounts of information." - Ellen Clark, FBI

"Call me a geek, but this is FUN!" - Frank Dixon, Babcock & Wilcox Company

"Overall the course continues to be chock full of megalicious forensicness. Thanks a bunch for the key knowledge." - Vincent Bryant, Blue Cross Blue Shield of Tennessee

"If you were not interested in forensics before, you will be after this class. For those who already love it, it is reassurance that you are doing the right thing with your life." - Cleora Madison, Walt Disney Theme Parks and Resorts

"The Registry labs are invaluable. I learned more in this class about registry than in 10 years at work. Thanks!" - Michael Mimo, JP Morgan

"I was really looking forward to Windows in-depth and that is exactly what we are getting!" - Joshua Hoover, Charles Schwab

"I have been using forensics tools for years. I never professed to know it all; however, I did not expect to learn as much as I did." - Jody Hawkins, Cook Children's Health Care System

"I really appreciate the prebuilt and configured SIFT workstation. The FOR500 class materials and instruction were outstanding." - Clint Modesitt, LSUHSC

"FOR500 is absolutely necessary for any computer forensic type career. Excellent information!" - Rebecca Passmore, FBI

"This course was by far the most informative and well taught class I have attended." - Brian Periera, Farfield Police Department

"Love the amount of detail/info in books, love the VM." - Jeff Datzman, Vacaville Police Department

"Best course I have taken in 20 years." - Gary Sanders, Louisiana Workers' Compensation Corporation

"The hands-on labs are excellent - best I have had in 15 years of forensics classes. The best books as well." - Shawn Bostick, Arkansas Attorney General's Office

"This is by far the best training I have ever had. My forensic knowledge increased more in the last five days than in the last year." - Vito Rocco, University of Nevada, Las Vegas

"Are you kidding me? I, personally, see this course (FOR500) as pretty much perfected." - Mike Bowden, Boeing

"There's not a lot of courses that cover depth as well as the width of material. I think FOR500 strikes the right balance between the two." - Wayne Dawson, Vancity Savings Credit Union