Course Objectives

The Advanced Windows® Forensic analysis class is an expert-level training course, designed for examiners who are familiar with the principles of digital forensics and keen to expand their knowledge on advanced forensics using a host of third-party tools to improve their digital investigations techniques.

The Spyder Forensic Advanced Windows® Forensic Analysis course will give participants unbiased knowledge and skills necessary to analyze artifacts left behind through system and user interaction with the host system, utilizing industry standard tools and open-source applications to explore the data in greater depth by learning how applications function and store data in the file system.

Students will learn to use various applications and utilities to successfully identify, process, understand and document numerous Windows artifacts that are vitally important to forensic investigations. The participant will also gain knowledge on how to process Chromium Edge browser history, cookies, and other database analysis including examination of BitLocker encryption, the Windows Action Center, Windows 10 TimeLine and other Windows 10 specific artifacts. The course includes gaining in-depth knowledge of JumpLists, Registry analysis and prefetch files and how they relate to forensic investigations and conclude with an in-depth look at OneDrive and synchronization processes between trusted devices, SQLite forensics plays a big role in the analysis of data therefore students will gain detailed knowledge in scripting and data exploitation.

We will use a variety of open source and leading forensic applications to examine key artifacts through multiple hands-on labs and student exercises.

Primary Learning Objectives

Day 1 of the Spyder Forensics Advanced Windows Forensics course begins with an overview of the course along with an introduction to the Instructor.

It also gives the participants the opportunity to introduce themselves to the Instructor and also to their fellow students, this however is not obligatory.

During Day 2 of the course we will examine user accounts and disuss their importance in any forensic investigation. We will also look at unautorized data access and this along with user accounts will enable us to build a timeline of events.

Day 3 of the Advanced Windows Forensics course will review the multitude of artifcats on a Windows system that gives the examiner important information that can indicate if the suspect was aware of particular data and importantly if they interacted with it. An important aspect of this are Windows Shortcuts and Jump Lists and we will also examine these.

The final day of the course we will identify items of interest associated with SQLite databases and also lok at Windows Apps, also known as Immersive Applications. We will follow this with an in-depth look at the Photos app, something that can be of great forensic importance.