Windows Forensics - Registry
Duration: 3 days.
Audience: Forensic investigators with experience in forensic case work and basic working knowledge of
FTK, FTK IMager, Registry VIewer and PRTK.
Pre-requisites: Read and understand the English language
Attend the AccessData Forensic Bootcamp and Windows Forensics or have equivelant experience with FTK and PRTK.
Have previous investigative experience in forensic case work.
Be familiar with the Microsoft Windows environment
Topics Covered: Introduction
Preliminary Case Info
Security Accounts Manager Registry Files (SAM)
SYSTEM Registry Files
SECURITY Registry Files
SOFTWARE Registry Files
Application Behaviour Part I
Application Behaviour Part II
Trojan Hourse Defence Issues
PDF Course Outline