CYBF 644 Windows Forensic Examinations

Provides information essential to the performance of a forensic examination on a computer running the Microsoft Windows Operating System. Exercises focus on disk level forensic tools and techniques. This course focuses on the underlying operation of automated forensic tools, identifying the most appropriate forensic tool to be used in specific circumstances, and defending the selection of forensic tools in the courtroom under cross examination. The course will use leading edge tools from X-Ways, Helix, and EnCase.