Intro to Windows Digital Forensics and Incident Response

Name: Intro to Windows Digital Forensics and Incident Response
Rating: 4.4 (412 reviews)

An introduction class for security professionals and stduents.

Created byRobert McMillen

Last updated 9/2023

English

English [Auto],Turkish [Auto],

What you'll learn

digital forensics
incident response
Microsoft Windows
cybersecurity

Course content

7 sections • 21 lectures • 2h 50m total length

Introduction0:48
Introduction to the course

02_01 What is the science of digital forensics2:16
Discover what digital forensics entails and how investigators identify what happened, where intrusion originated, and the damage using siem tools for file system, memory, and network forensics and incident response.
02_02 Acquiring data9:37
Acquire data for digital forensics using disk images, memory images, logical disk to disk copies, and sparse copies with autopsy, ensuring admissible data under NIST and chain of custody.
02_03 Incident Preservation3:55
Identify and isolate devices with data, extract and create secure forensic images, analyze recovered data with keyword searches and carving, and document and present findings for legal outcomes.
Section 2 Quiz

05_01 How to install Autopsy computer forensic application3:18
Explore how to install Autopsy, enable the central repository, set up a forensic workstation, and analyze a virtual machine for evidence.
05_02 How to Build a Case in Autopsy9:07
05_03 Network Traffic Analysis9:48
Use Wireshark and Nmap/Zenmap to scan networks, analyze packets, and identify open ports. Learn to apply firewall rules and isolate compromised devices in a forensic workflow.
Section 5 Quiz

06_01 Review the registry for changes by the hacker11:50
Explore how to inspect the Windows registry for hacker activity using regedit, Registry Explorer, and RegRipper; copy the registry with transaction logs and analyze keys, executables, and DLLs.
06_02 Review Current Processes in RAM for Analysis6:58
06_03 Use a SIEM solution4:34
06_04 Malware Testing12:31
06_05 Analytical Thinking6:54
Develop analytical thinking to break down complex data and identify patterns in digital forensics and incident response, then test hypotheses with evidence and prepare clear reports for executives and courts.
Section 6 Quiz

Requirements

Experience using Microsoft Windows, some networking experience, and a passion for learning security

Description

Professor Robert McMillen has created over 100 IT courses for companies such as LinkedIn Learning, Pluralsight, The InfoSec Institute, and now Udemy.

Intro to Windows Digital Forensics and Incident Response is an introduction course to all the tools, knowledge, and demonstrations needed to get started in a career as a digital forensics investigator and incident responder. View demonstrations using tools built into Windows as well as third party tools downloaded from the internet. Learn data preservation, emergency response preparedness, how to respond to an incident legally and professionally, how to know if you have been hacked by reviewing the registry, antimalware programs, and SIEM log aggregation tools. Included are commands, an incident response document to download, and a quiz to test your knowledge.

Create a case with Autopsy and preserve current processes in RAM using free tools that can produce results produced into courtrooms with proper chain of custody. Learn how to be a white hat hacker using tools such asn Zenmap and Wireshark. You'll see like demonstrations of sending and receiving data packets in a way you'll understand.

Learn to be part of an emergency response team and understand the order of action when malware is discovered on your network. You'll be the IT hero and use forensics skills to locate the attacker as well as properly respond to the incident.

Who this course is for:

Beginner security professionals and students

Intro to Windows Digital Forensics and Incident Response

What you'll learn

Explore related topics

Course content

Introduction1 lecture • 1min

The process of digital forensics and data preservation3 lectures • 16min

Incident Response4 lectures • 45min

DFIR Demonstrations4 lectures • 43min

Digital Forensics Tools demos3 lectures • 22min

SIEM tools Malware Testing and Analytical Thinking5 lectures • 43min

Summary1 lecture • 1min

Requirements

Description

Who this course is for: