Denise Duffy

Learn to collect and analyze artifacts in system memory and on disk. As you proceed, you’ll cover many common Windows OS artifacts showing evidence of program execution and file access. We will demonstrate dealing with file compression and recovering file metadata and EXIF data. The student will take a deep dive into examining evidence left behind by browsers, including specific detailed examination or popular browsers such as Chrome, Firefox and Edge.

In this path, you will learn about the various techniques used by malware to persist, propagate, disrupt, modify and enumerate infected hosts and networks. This path will prepare you to statically and dynamically analyze malware, as well as document the analysis. It will also provide you with the skills to properly mitigate the malware intrusion. You will be able to apply these skills toward real-world security incidents and computer intrusions caused by malware.

In the Digital Forensics Concepts path, the student will learn about legal considerations applicable to computer forensics and how to identify, collect and preserve digital evidence. This path dives into the scientific principles relating to digital forensics and gives the student a close look at on-scene triaging, keyword lists, grep, file hashing, report writing and the profession of digital forensic examination.

The Advanced Adversary Tactics path will be updated regularly to include new content. Completing the path will give you hands-on experience with a wide variety of different techniques that will allow you to identify and understand adversarial tactics and techniques. By carrying out attack methods, you’ll be able to identify how attackers think and move through networks. By the end you’ll know how attackers set up cloned websites, establish persistence with trojanized binaries, pivot through networks, and much more.

The student will learn how these systems store data, what happens when a file gets written to disc, what happens when a file gets deleted from disc, and how to recover deleted files. The student will learn how to correctly interpret the information in the file system data structures, giving the student a better understanding of how these file systems work. This knowledge will enable students to validate the information from multiple forensic tools properly.

This learning path teaches you the necessary skills to conduct a complete and accurate examination of the Windows Registry. As you progress through 13 courses, you’ll build the necessary skills to define and understand the Windows Registry. You will be able to locate the registry files within a computer’s file system, both live and non-live. The path will show you how to examine the registry and locate data significant to your investigation, correctly interpret the significant data found within the registry and put all your findings together to form a fact-based conclusion for your report.