TCM Security – Practical Windows Forensics

The objective of this course is to show students how to perform a full digital forensic investigation of a Windows system in a complete DIY setup. The course covers a full digital forensic investigation of a Windows system. It begins with the simple preparation of our lab, which consists of setting up a “victim” VM and a forensic workstation. We’ll then run an attack simulation script on the victim VM that simulates attack patterns as commonly observed by threat actors in the industry to create a realistic setting for our investigation. From there, we’ll kick off the forensic process, beginning with the data collection, examination and extraction before diving deeper into the analysis of the information at hand.

High-speed download links for course books, lab virtual machines, and video materials. Use archive password: cyberlabarchive when extracting.