Course

Certified File System & Registry Forensics Expert

Registry, NTFS, timeline analysis.
Get Started
AU
Admin User
Course Instructor
Overview

Overview

Overview
Announcements
forum
Get access
Lessons

File System Internals

Topics:

  • NTFS: MFT, UsnJrnl, ADS

  • Ext4 journaling

  • Data carving logic

Activities: 0

Registry Forensics (Windows)

Topics:

  • SYSTEM, SOFTWARE, SAM hive artifacts

  • User activity (MRU lists, Run keys)

  • Login, shutdown, USB history

Activities: 0

Building Forensic Timelines

Topics:

  • Super timeline methodology

  • Event logs, browser logs, registry correlations

Assignment:
Build timeline for a user login scenario.

Activities: 0

Reporting

Topics:

  • Presenting artifact-based evidence

  • Timeline visualization

Activities: 0