Catalogue · MOD-DEF-08

Windows Forensics

When a Windows host is compromised, the investigator reconstructs what happened. This module trains you in forensic investigation: evidence acquisition, artefacts, memory, timeline and admissible report.

Defence (Blue) Praticien 6 bricks 10 labs ≈ 18.5 h 5 real cases

Objectives

• Acquire evidence while preserving its integrity • Reconstruct execution and persistence • Analyse memory (Volatility) • Build a timeline and an admissible report

Module bricks

BRQ-DEF-039 — Windows evidence acquisition & integrity (FTK Imager) (1 lab(s))
BRQ-DEF-040 — Execution & persistence artefacts (RegRipper) (2 lab(s))
BRQ-DEF-041 — Registry & user artefacts (Hindsight) (2 lab(s))
BRQ-DEF-042 — Memory analysis (Volatility) (1 lab(s))
BRQ-DEF-043 — File system & anti-forensics (MFTECmd) (2 lab(s))
BRQ-DEF-044 — Super-timeline & forensic report (Plaso) (2 lab(s))

Order this module View full catalogue