

| Course | Topic |
|---|---|
| Windows Digital Forensics And Advanced Data Triage | Windows Operating System Components |
| Core Forensic Principles | |
| Live Response and Triage-Based Acquisition Techniques | |
| Acquisition Review with Write Blocker | |
| Advanced Acquisition Challenges | |
| Windows Image Mounting and Examination | |
| NTFS File System Overview | |
| Document and File Metadata | |
| File Carving | |
| Custom carving signatures | |
| Memory, Pagefile, and Unallocated Space Analysis | |
| Core Windows Forensics: Windows Registry Forensics And Analysis |
Registry Core |
| Profile Users and Groups | |
| Core System Information | |
| User Forensic Data | |
| Tools Used | |
| Core Windows Forensics: Windows Registry Forensics And Analysis |
Shell Item Forensics |
| USB and Bring Your Own Device (BYOD) Forensic Examinations | |
| Core Windows Forensics: E-Mail, Key Additional Artifacts, And Event Logs |
E-mail Forensics |
| Forensicating Additional Windows OS Artifacts | |
| Windows Event Log Analysis | |
| Core Windows Forensics Part IV: Web Browser Forensics | Browser Forensics |
| Windows Forensic Challenge | Digital Forensic Case |
| Presentation |