Windows Forensics: Finding Evidence of Execution in DFIR

When a security incident occurs on a Windows system, knowing exactly what ran and who ran it is critical for any investigator. This text-based course guides you through identifying, decoding, and analyzing key Windows execution artifacts to reconstruct user and system activity. You will learn to: Understand the core concepts of Windows registry and file system forensics; Analyze execution artifacts including Prefetch, Amcache, ShimCache, and UserAssist; Identify key Event IDs to trace process starts, PowerShell activities, and user logons; Attribute system executions to specific user accounts to map out security incidents; Recognize modern execution patterns, including Living off the Land techniques; Practice reconstructing timelines using written scenarios and step-by-step forensic walkthroughs. You will start with foundational definitions of Windows architecture and forensic terminology before diving deep into specific artifacts and log analysis. This course is designed for aspiring digital forensics professionals, system administrators, and security analysts with no prior DFIR experience. Start building your Windows incident response skills today.