Investigations involving Windows-based operating systems occur every day. As a result, it is essential for the investigator to know how to examine the critical files and structures of a Windows operating system. This day will provide an in-depth study and examination of the forensic evidence left on Windows 7, VISTA, Windows XP, and Windows server-based operating systems. This hands-on forensic course will arm you with methods and techniques to investigate critical areas of the Windows operating system for any case.

Beginning with the Windows Registry, the investigator will learn how to discover critical user and system information from the Registry that is pertinent to any investigation. Each examiner will learn how to examine the Registry to obtain user profile data and system data. The course will also teach each investigator how to show that a specific user performed key word searches, ran specific programs, opened and saved files, and list the most recent items in use.

Finally, USB Device investigations are becoming more and more a key part of performing computer forensics. We will show you how to perform in-depth USB device examinations on Win7, Vista, and WinXP machines. We will show you when the device was first plugged in, last plugged in, the vendor/make/model, and even tell you the unique device that was used.

Throughout the day, the investigator will utilize their skills in a real hands-on case, exploring evidence and artifacts discussed throughout the day.