DF310 Advanced Digital Forensic Analysis: Windows

Register Here

Delivery Method: Virtual
Location: Online
Duration: 4 Days
Date: 02/05/2024 – 02/08/2024
Time: 9:00 AM – 6:00 PM Eastern

This course covers the identification and extraction of artifacts associated with the Microsoft® Windows® operating system. Topics include the change journal, BitLocker®, and a detailed examination of the various artifacts found in each of the Registry hive files. Students also examine Event Logs, Volume Shadow Copies, link files, and jump lists. This course uses a mixture of lecture, discussion, demonstration, and hands-on exercises.

Key concepts covered in this course include:
• The registry
• Shellbags
• Mounted devices
• Change journal
• Prefetch

Excel Office 365 is recommended, versions 2010 and newer will be functional.

Closed captioning is always available to students. Live speech-to-text language translations to 100 different languages is also available. Contact support@nw3c.org if you would like this service.

    Students who complete this course are eligible for 1.0 point toward the 3CE certification.

Student Testimonials
“Recently we received three child pornography investigations from the National Center for Missing and Exploited Children NCMEC. These examinations were somewhat more difficult and I used the skills I learned in this class to successfully extract artifacts which substantially increased the successful extraction of evidence. All three cases have been submitted and all suspects charged.” -Richfield, MN

“The knowledge I have gained from the courses assist me daily in investigations. I have used the information gained on dozens of cases. Several leading to arrests and convictions. This course help me increase my understanding, as I am working in my computer forensic software.” -Oakland, CA

Mandatory 100% Participation
To receive a certificate upon completion of this course, the following must be completed:
• Score of 80% or above on post-test
• Complete all in-class exercises

Cancellation
NW3C may cancel any class for any reason and without notice. NW3C is not responsible for non-refundable travel accommodations lost or rendered moot as a result of a class cancellation.

    Closed captioning is always available to students. Live speech-to-text language translations to 100 different languages is also available. Contact support@nw3c.org if you would like this service.