FOR500: Windows Forensic Analysis

摘要

MASTER WINDOWS FORENSICS - YOU CANT PROTECT WHAT YOU DONT KNOW ABOUT FOR500: Windows Forensic Analysis will teach you to: 1. Conduct in-depth forensic analysis of Windows operating systems and media exploitation focusing on Windows 7, Windows 8/8.1, Windows 10, and Windows Server 2008/2012/2016 2. Identify artifact and evidence locations to answer critical questions, including application execution, file access, data theft, external device usage, cloud services, geolocation, file download, anti-forensics, and detailed system usage 3. Focus your capabilities on analysis instead of on how to use a particular tool 4. Extract critical answers and build an in-house forensic capability via a variety of free, open-source, and commercial tools provided within the SANS Windows SIFT Workstation