https://www.sans.org/cyber-security-courses/windows-forensic-analysis/
Learn how to recover, analyze, and authenticate forensic data on Windows systems, track user activity, and organize findings for incident response and investigations. This course covers Windows 7, 8/8.1, 10, 11, and Server products, as well as cloud storage, Office, and browser forensics.

https://www.geeksforgeeks.org/windows-forensic-analysis/
Learn what Windows forensic analysis is, what are forensic artifacts, and what are some of the open-source tools for Windows forensic analysis. This article covers topics such as recycle bin, browsers, error reporting, RDP cache, LNK files, jump lists, prefetch files, and more.

https://www.coursera.org/learn/windows-os-forensics
Learn how to examine Windows file systems, recover deleted files, and interpret the Registry in this online course. Enroll for free and earn a career certificate in computer forensics.

https://psmths.gitbook.io/windows-forensics
Welcome. This handbook provides an in-depth guide to the various Windows forensic artifacts that can be utilized when conducting an investigation. Detailed information is provided for each artifact, including its location, available parsing tools, and instructions for interpreting the results of a forensic data extraction.

https://www.infosecinstitute.com/resources/digital-forensics/forensic-investigation-windows-machines/
Windows registry forensics. What is the Windows Registry? A central hierarchical database used in Microsoft Windows is used to store information that's necessary to configure the system for multiple users, applications and devices. The registry debuted in Windows 95 and has been used in every Windows OS ever since.

https://github.com/bluecapesecurity/PWF
Use the Practical Windows Forensics - Cheat Sheet to guide your investigations. Steps TLDR: Prepare a Windows target VM. Execute attack script (based on the AtomicRedTeam framework) on target VM. Acquire memory and disk images. Setup a Windows forensic VM. Get started with your Windows forensic analysis.

https://www.sans.org/blog/sans-for500-updated-for-windows-11-and-beyond/
Knowing the diverse enterprise landscape, the skills taught in FOR500 are now applicable for performing forensics across every modern version of Windows, from XP to Windows 11, in addition to the corresponding Windows Server versions. The Fall 2021 and Spring 2022 updates resulted in over 50% of the course being re-written and re-imagined.

https://www.sans.org/posters/windows-forensic-analysis/
The "Evidence of..." categories were originally created by SANS Digital Forensics and Incidence Response faculty for the SANS course FOR500: Windows Forensic Analysis. The categories map a specific artifact to the analysis questions that it will help to answer. Use this poster as a cheat-sheet to help you remember where you can discover key Windows artifacts for computer intrusion

https://www.coursera.org/programs/oc-am-btech-cse-5391r/learn/windows-os-forensics?specialization=computerforensics
The Windows OS Forensics course covers windows file systems, Fat32, ExFat, and NTFS. You will learn how these systems store data, what happens when a file gets written to disc, what happens when a file gets deleted from disc, and how to recover deleted files. You will also learn how to correctly interpret the information in the file system data

https://www.udemy.com/course/intro-to-windows-digital-forensics-and-incident-response/
Intro to Windows Digital Forensics and Incident Response is an introduction course to all the tools, knowledge, and demonstrations needed to get started in a career as a digital forensics investigator and incident responder. View demonstrations using tools built into Windows as well as third party tools downloaded from the internet.

https://niccs.cisa.gov/education-training/catalog/sans-institute/windows-forensic-analysis
Learn how to recover, analyze, and authenticate forensic data on Windows systems, track user activity, and identify insider threats. This course covers Windows 7, 8/8.1, 10, Server 2008/2012/2016, Office, cloud storage, and more.

https://www.coursera.org/learn/windows-registry-forensics
Module 1 • 45 minutes to complete. Discover what the Windows Registry is and why it is important in digital forensic investigations. This module will explore the location and structure of the registry hives in a live and non-live environment, as well as the types of forensic evidence found in the Windows Registry.

https://bluecapesecurity.com/courses/practical-windows-forensics-lab/
Practical Windows Forensics + Online Lab. This course includes the Practical Windows Forensics (PWF) course and 50 hours of online lab access! You will learn how to perform an in-depth, hands-on forensic investigation of a Windows system, from start to finish. Students will become familiar with the forensic process, a wealth of important

https://www.forensicfocus.com/articles/windows-forensics-and-security/
Learn about digital forensics, cyber forensics and Windows artifacts. Find out how to preserve, acquire, authenticate and analyze data from Windows systems for investigation and security purposes.

https://www.pentesteracademy.com/course?id=23
This course will familiarize students with all aspects of Windows forensics.By the end of this course students will be able to perform live analysis, capture volatile data, make images of media, analyze filesystems, analyze network traffic, analyze files, perform memory analysis, and analyze malware for a Windows subject on a Linux system with readily available free and open source tools.

https://usa.kaspersky.com/about/press-releases/2024_kaspersky-introduces-new-windows-digital-forensics-online-cybersecurity-training
The Windows Digital Forensics course is designed to provide trainees with a fundamental understanding of digital forensics, offering them valuable insights and hands-on experience. The ability to detect digital traces of an attack's development is one of the most valuable skills for cybersecurity professionals, as attacks can occur even if

https://learn.microsoft.com/en-us/windows-365/enterprise/digital-forensics
Digital forensics is the science that addresses the recovery and investigation of digital data to support criminal investigations or civil proceedings. To support these forensics, Windows 365 offers the ability to place a Cloud PC under review. This action will securely save a snapshot of the Cloud PC to the customer's Azure Storage Account.

https://ine.com/learning/courses/windows-forensics
What about this course? This course will familiarize students with all aspects of Windows forensics. By the end of this course, students will be able to perform live analysis, capture volatile data, make images of media, analyze filesystems, analyze network traffic, analyze files, perform memory analysis, and analyze malware for a Windows subject on a Linux system with readily available free

https://infosecwriteups.com/windows-forensic-101-how-to-perform-forensic-investigation-of-windows-machine-d1dfbea20254
Windows forensic investigation is a critical process for detecting hidden threats on a system. The investigation involves analyzing various sources of evidence, including the prefetch files, browser history, network connections, file system, vulnerabilities, installed applications, startup tasks, scheduled tasks, services, and registry keys.

https://www.winfe.net/
The Windows Forensic Environment ("WinFE") write-protect tool is provided free of charge. This web-site (https://www.winfe.net) is the only authorised distribution platform for the WinFE write-protect tool and associated applications. It may be distributed freely providing no reward, financial or otherwise is received.

https://training.13cubed.com/
Master Windows forensic investigation with the ultimate bundle: 365-day access to Investigating Windows Endpoints and Investigating Windows Memory. Crafted for beginners and seasoned professionals alike, these courses provide a seamless progression from endpoint analysis to in-depth memory forensics. Each course includes a certification/digital

https://www.sans.org/blog/updated-windows-forensic-analysis-poster/
The new version of the FOR500: Windows Forensics Poster was a nearly complete re-write of the poster with significant updates made to every section. November 22, 2022. I am thrilled to announce the latest release of the SANS DFIR Windows Forensic Analysis poster. This version was a nearly complete re-write of the poster with significant updates

https://windowsforensics.net/
WINDOWS FORENSICS. In the world of cyber security, we often rely on digital forensic artifacts to tell a story. windowsforensics.net provides the knowledge and resources necessary to tell that story.. Learn Now

https://iboysoft.com/bitlocker/bitlocker-decryption-tool.html
Elcomsoft Forensic Disk Decryptor: Windows and macOS: No: No: Not applicable: Not applicable: Complicated: $699: What is a BitLocker decryption tool? A BitLocker decryption tool is designed to decrypt drives that have been encrypted using Microsoft's BitLocker. It can either permanently remove BitLocker encryption from a drive, converting it

https://bluecapesecurity.com/courses/practical-windows-forensics/
In the 201 Practical Windows Forensics DIY Edition you build your own lab, prepare resources, and conduct a comprehensive Windows forensic investigation. It includes lifetime access to course materials. The Practical Windows Forensics (PWF) is a self-paced course that teaches how to perform a complete digital forensic investigation of a Windows system.

https://www.kaspersky.com/about/press-releases/2024_kaspersky-statement-on-the-us-commerce-department-determination
Kaspersky introduces a new online cybersecurity training 'Windows digital forensics' Kaspersky has added a new cybersecurity course on digital forensics to its ever-expanding Expert Training portfolio. InfoSec professionals can now master the techniques of identifying, processing and analyzing digital evidence with experienced Kaspersky