CVF 1081 - Advanced Windows Forensics

1. Guidance Software EnCase
   1. EnCase Overview
   2. EnCase Interface
   3. Basic Data Analysis
   4. Creating a Case
   5. Narrowing/Filtering data
   6. Reporting
   7. Keyword/Pattern Searching
2. Cryptography Understand the fundamentals of encryption Understand decryption technologies Identify and recover encrypted data Perform decryption on various files
3. Email Analysis Microsoft Outlook Microsoft Mail Web-based email Email headers
4. Examining Windows Artifacts (XP, Vista, 7) Directory Structure Recycle Bin Thumbs.db Shortcut/Link (LNK) Files Prefetch Restore Points File metadata Volume Shadow Copy Log files
5. Live Analysis & Incident Response Understand requirements for live response Perform analysis on a live system Employ automated toolkits to collect information from Windows-based systems Understand and implement Incident Response technologies Perform imaging and analysis of Windows-based systems
6. Memory Analysis Issues in collecting Windows memory Image and analyze Windows memory Identify registry data in memory Identify process information in memory Identify passwords in memory
7. Web Browser Analysis (Internet Explorer, Firefox, Chrome) Internet history Cookies Cached files Recovering deleted history Private browsing
8. Windows Registry Analysis Identify the structure of the Windows registry identify and understand Windows registry artifacts Locate and examine deleted Windows registry data Perform testing of applications in the Windows registry Perform analysis of the Windows registry

1. employ automated toolkits to collect information from Windows-based systems
2. perform analysis of the Windows registry
3. identify and recover encrypted and hidden data
4. implement Incident Response Technologies
5. perform imaging and analysis of Windows-based systems
6. perform analysis on a live system

Courses and Registration