Investigations involving Windows-based operating systems occur frequently. As a result, it is essential to make an in-depth study and examination of the forensic evidence left on Windows-based operating systems. This hands-on forensic course will arm you with methods and techniques to respond and investigate complex events for your organization. It covers Windows methods that will ensure maximum evidence capture without poisoning key evidence that might reside on the system and in memory.

You will learn how to use freely available Windows tools and methods to secure a system without disturbing it, discover hidden malware, and find hidden clues that may still reside on the system. Each student will also learn how to examine restore point snapshots in Windows XP and examine Shadow Copy volumes on Windows Vista and Windows 7.

This course covers Microsoft Windows 2000, Windows XP, Windows 2003, Windows Vista, and Windows 7. Even though they all use NTFS or FAT for the file system, each one is different and there are some variations on the type of forensic data that might be found on each operating system.