Home
>
Courses
>
Windows Forensics
Course

Windows Forensics

The Windows Forensics course teaches the techniques and tools to investigate and analyze digital evidence within Windows systems. It covers exploiting techniques and tools, storage, memory, registry, and log analysis. By the end of the course, students will be proficient in performing comprehensive forensic investigations and constructing detailed timelines of system events.

Hour Course Icon
Hours
40 Academic Hours
Format Course Icon
Format
Online
Duration Course Icon
Duration
4 Weeks

LIVE, instructor-led training

Participants will gain a holistic understanding of how to:

• Lead cybersecurity strategy at agency and national level

• Govern large-scale incident response and multi-agency crises

• Secure modern cloud and digital service platforms

• Embed security into digital product deliveries

• Prepare organisations for AI-driven and next-generation threats

The bootcamp combines executive briefings, case studies, interactive workshops, and hands-on cyber exercises delivered on CyberproAI’s Cympire Cyber Range, enabling leaders to experience real-world cyber crises in a controlled, immersive environment.

Learning Outcomes

This course is designed for cybersecurity professionals, IT practitioners, and ethical hackers looking to deepen their expertise in web application security.

It’s ideal for those who already have a foundational knowledge of networking and security and want to advance their skills in identifying, exploiting, andmitigating web-based vulnerabilities. Whether you’re a penetration tester, security analyst, or IT manager, this course will provide practical tools and insights to help you defend against modern cyber threats targeting web applications.

Target Audience

This program is designed for IT professionals, cybersecurity analysts, digital forensics investigators, incident responders, and system administrators with a foundational understanding of IT systems, Windows operating systems, cybersecurity fundamentals, and forensic investigation techniques.

The ideal participants are those looking to deepen their expertise in forensic analysis, specifically in Windows environments. This course is precious for individuals in roles that involve investigating security incidents, recovering and analyzing digital evidence, or auditing Windows-based systems for potential breaches. It is well-suited for professionals working in mid to largesized organizations who are responsible for ensuring the integrity and security of Windows infrastructure and need to enhance their ability to uncover and respond to malicious activities within these systems.

Required Prior Knowledge

• PowerShell

• Windows System

Training for CompTIA’s certifications

Learning Method

Computing Requirements

• CPU: Intel i5/i7 or AMD 5x/7x

• RAM: 16GB

• HDD: 300GB available space

Introduction to Windows

  • A brief History of Windows
  • Sorting Out the Different Versions and Editions
  • Windows into the Future
  • Digital Forensics in a Rapidly Changing Space

Triage Acquisiton and Analysis

  • Rapid Assesment of Windows Behavior
  • Rapid Acquisition of Artifacts
  • Windows Incident Response

Windows File System

  • TFS Internals and the Master File Table (MFT)
  • The File Allocation Table (FAT12/16/32/exFAT)
  • Generating Filesystem Timeline Scanning

Disk Image Acquisition

  • Image Acquisition Tools for Windows
  • Remote Image Acquisition
  • Master File Table (MFT) Repair

File Carving in NTFS and FAT

  • Understanding Cluster Chains
  • Understanding Alternate Data Stream (ADS)
  • The Sleuth Kit (TSK) on Windows
  • Using Autopsy

Memory Acquisition

  • Exploring Various Tools for Windows RAM Acquisition
  • Remote RAM Image Acquisition

Memory Analysis

  • Using Volatility with Windows
  • Using Mandiant’s Redline

Windows event logs (EVTX)

  • Application, security and system logs
  • Other Service Logs
  • Log Processing and Analysis with PowerShell

Registry Analysis

  • Registry file Acquisition
  • Using FTK Imager
  • Registry Structure

Active Directory Infrastructure

  • Prominent Security Features in AD
  • Well Known Weaknesses in AD
  • Windows AD Authentication and Kerberos

Active Directory Infrastructure

  • Sources of Information
  • Application, Systema and Security Logs
  • Other Logs
  • Using Log2TimeLine

Learn More
Register
Arrow Icon

$ 4200*

$ 5400

* Special Launch Pricing - Act Fast
* The price is excluding booking of
venue and refreshments
Learn More
Register