Practical Windows Forensics: Accelerated

This course is designed for the following:

• SOC analysts

• DFIR professionals

• Incident responders

• Threat hunters

• Security engineers

• Red teamers who want to better understand forensic visibility

• Technical managers who want practical familiarity with Windows forensic evidence

Beginner to intermediate.

This workshop is appropriate for students who understand basic security concepts and Windows fundamentals but want more structured, hands-on experience with forensic evidence and investigation workflows.

Students should have:

• Foundational cybersecurity knowledge

• Basic understanding of Windows systems

• Familiarity with files, users, processes, services, and event logs

• General understanding of incident response concepts

Prior forensic experience is helpful but not required.

By the end of the workshop, students will be able to:

• Explain a practical Windows forensic investigation workflow

• Understand the difference between triage collection and deeper forensic analysis

• Navigate common Windows forensic evidence sources

• Use registry artifacts to identify system, user, and activity evidence

• Interpret UserAssist, RecentDocs, and Shellbags for user behavior analysis

• Analyze NTFS metadata and MFT records for file activity

• Use execution artifacts such as BAM, ShimCache, Amcache, and Prefetch

• Identify and investigate scheduled task persistence

• Review relevant Windows Event Logs for authentication, Defender, service installation, and PowerShell activity

• Perform basic memory analysis with Volatility

• Identify suspicious processes and possible injected DLLs

• Correlate multiple artifacts into a defensible investigative timeline

• Write concise, evidence-backed forensic findings