Topics:

• NTFS, FAT32, EXT4 structures

• MFT records, timestamps, metadata

• Slack space & unallocated space

• Shellbags, LNK files, prefetch

Topics:

• Physical vs logical imaging

• Recovering deleted files

• Carving techniques

• Journal analysis

Topics:

• Multi-artifact correlation

• Timeline creation using file system + registry + logs

• Detecting user activity patterns

• Reconstructing intrusion behavior

Topics:

• Evidence interpretation

• Professional reporting

• Visualizing timelines

• Reporting inaccuracies to avoid