Windows Forensic Analysis

  • Windows Forensic Analysis
  • France - Paris

Windows Forensic Analysis

Course Category : Data Management

An advanced specialist programme for interpreting Windows forensic artefacts, correlating user activity with system evidence, and supporting investigations and incident response through accurate, defensible findings.
Duration: 5 Days
Level: Advanced.

Starts On

16 - November - 2026

Ends On

20 - November - 2026

Location

France - Paris

Language

English

View the course details and register to enroll.

Register Now

View Course Introductory PDF

Targeted Audience

  • Information Security and Cybersecurity Professionals
  • Digital Forensic Analysts
  • Cyber Incident Response Team Members
  • Cybercrime and Computer Crime Investigators
  • Law Enforcement Officers and Digital Evidence Investigators
  • Cyber Defence Forensic Analysts
  • Digital Media Exploitation Analysts
  • Internal Investigation and System Misuse Specialists
  • Professionals with a Background in Information Systems, Information Security, or Computing

Targeted Skills

  • Windows Forensic Artefact Analysis
  • Digital Forensic Triage and Evidence Prioritisation
  • NTFS Structure and File Activity Interpretation
  • Windows Registry and System Data Analysis
  • Programme Execution and File Access Tracking
  • USB, Shell Item, and Cloud Storage Forensics
  • Email, Windows Search, SRUM, and Event Log Analysis
  • Web Browser and Application Database Forensics
  • Multi-Source Evidence Correlation and Timeline Development

Expected Outcomes

  • Interpret the principal components of Windows systems from a digital forensic perspective.
  • Identify appropriate evidence sources for rapid forensic triage.
  • Analyse NTFS structures and correlate MFT and USN Journal records with file activity.
  • Derive user, system, and programme-execution information from the Windows Registry.
  • Trace USB usage and interaction with local, network, and removable storage locations.
  • Assess artefacts associated with cloud storage, deleted content, and locally cached files.
  • Analyse email, Windows Search, SRUM, and Windows Event Log evidence.
  • Interpret artefacts generated by Chrome, Edge, Firefox, Internet Explorer, and private browsing.
  • Explain the evidential role of SQLite, LevelDB, and ESE databases.
  • Organise and correlate forensic findings into a defensible investigative timeline.

Training Topics Index

  • Windows operating-system versions, components, and associated forensic artefacts
  • Core digital forensic principles and the integrity of data under examination
  • Live response and triage-based extraction and prioritisation concepts
  • Windows image examination and document and file metadata
  • Volume Shadow Copies, memory, pagefile, and unallocated-space analysis

  • Logical NTFS architecture, volumes, and system records
  • The Master File Table and its role in recording files, folders, and attributes
  • File attributes, timestamps, and resident and non-resident data
  • Alternate Data Streams, concealed storage indicators, and file and stream carving
  • USN Journal analysis for tracking file creation, modification, movement, renaming, and deletion

  • Windows Registry architecture and principal Registry hives
  • User profiles, groups, system information, and programme-execution artefacts
  • OneDrive, Google Drive, Dropbox, and iCloud forensic artefacts
  • Shell Items and ShellBags across local, network, and removable locations
  • USB and BYOD profiling, including connection times, user attribution, and device properties

  • Email evidence from Outlook, Exchange, workstations, and cloud accounts
  • Correlation of messages, attachments, metadata, and investigative timelines
  • Windows Search Database and indexed file metadata and content
  • System Resource Usage Monitor and application and resource-usage evidence
  • Windows Event Logs, user logons, remote sessions, and system unlocking activity

  • Google Chrome, Microsoft Edge, Internet Explorer, and Mozilla Firefox artefacts
  • Browsing history, downloads, links, sessions, and user data
  • Private-browsing evidence, privacy-cleaning activity, and residual artefact recovery
  • SQLite, LevelDB, ESE, Electron, WebView2, and chat-client databases
  • Correlation of browser, Registry, email, event, and file evidence and organisation of findings