Reward Yourself! Get a $400 Amazon Gift Card with OnDemand 5 or 6 Section Training - Register Today!


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Sorry, the slides for this webcast are not available for download.

Shell items, More than Meets the Eye

  • Monday, May 16, 2016 at 1:00 PM EDT (2016-05-16 17:00:00 UTC)
  • David Cowen

You can now attend the webcast using your mobile device!



Its time to revisit everyones favorite windows forensic resources; shell items. Whether you like to look at them as lnk files, jumplists, shell bags or registry entries they are everywhere. In recent years and in recent versions of Windows we keep finding more data within shell items we can use to make even more correlations and find more evidence! Tune in to see new research, tools and analysis you can use to take your case farther today.

Digital Forensics & Incident Response Summit
Austin, TX

Summit Dates: June 23-24
Training Course Dates: June 25-30
DFIR NetWars: June 27-28
Register at

SANS Annual DFIR Summit is the only event of its kind that gathers the most influential group of experts, the highest quality of training & the greatest opportunities to network with others in the field of Digital Forensics & Incident Response, all in one place! Attend the DFIR Summit and gain the investigative skills you need and the ones you never knew you needed.

Speaker Bio

David Cowen

Mr. Cowen has more than sixteen years of experience in the areas of integration, architecture, assessment, programming, forensic analysis and investigation. He currently holds the Certified Information Systems Security Professional certification from (ISC)^2. He has have been trained in proper forensics practices by the High Tech Crime Investigators Association, ASR Data and Guidance Software and SANS amongst others. He is an active contributor within the computer forensics community where he frequently present and train on various forensic topics. He has managed, created, and worked with multiple forensics/litigation support teams and associated procedures. His experience spans a variety of environments ranging from high security military installations to large/small private sector companies.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.