Advanced Windows Forensic Analysis (Live Remote – CDT) – March 2025

4-day Advanced Level Course

Course Overview

Delve into the intricacies of Windows forensics with our Advanced Windows® 10 Forensic Analysis course, tailored for seasoned examiners seeking to elevate their expertise. Over the span of four intensive days, participants will immerse themselves in an expert-level exploration of Windows® 10 digital forensics.

This comprehensive training equips attendees with the unbiased insights and technical prowess necessary to dissect artifacts left behind by system and user interactions within the host system. Through hands-on instruction utilizing industry-standard tools and open-source applications, students will gain a deep understanding of how applications operate and store data across the Windows® ecosystem.

Unraveling the complexities of Windows® 10, participants will master the identification, processing, comprehension, and documentation of critical artifacts essential for forensic investigations. From deciphering the intricacies of the Chromium browsers to unraveling BitLocker encryption, analyzing Windows® Action Center, TimeLine, and other platform-specific artifacts, this course leaves no stone unturned.

Highlights include a deep dive into JumpLists, Registry analysis, prefetch files, and an exhaustive examination of OneDrive and synchronization processes between trusted devices. Moreover, students will acquire advanced proficiency in SQLite forensics, honing skills in scripting and data exploitation for comprehensive data analysis.

Students will use a variety of open-source and leading forensic applications to examine key artifacts through multiple hands on labs and student practicals.

The course will follow adult learning principles through training aids such as presentations, diagrams, and practical instructor lead examples.  Each artifact covered will be presented in either one or two 50-minute sessions followed by review questions.  Students will be given the opportunity throughout the course to ask questions and discuss objectives covered in more detail.  Throughout each day students will have practical exercises to work on in order to reinforce the topics.

Course Price: $2,595

What is Live Remote Synchronous Training?

Remote Synchronous Training (RST) allows the attendee to participate in a structured training courses remotely, in the comfort of your own office. It eliminates travel costs and provides a fully interactive environment, just like being in the classroom! RST delivery is specifically designed to simulate a live learning environment. Students have two-way communication with the instructor as well as the other students in the class using a typical hardware setup from their remote location. Instructors can monitor and interact with all students at the same time. When needed, instructors can assist students by physically interacting with his/her assigned machine in the Spyder Forensics remote classroom.