Advanced Windows Forensic Analysis

Built on Northgate Engineering — not abstract examples

Three investigation scenarios thread through the entire course, each using NE's infrastructure:

INC-NE-2026-0915 — Insider Data Exfiltration. A departing engineer copied proprietary manufacturing specifications to USB and cloud storage over 6 weeks. Legal hold in effect. Evidence must be court-admissible.

INC-NE-2026-1022 — Ransomware Attack. Attacker gained access via phishing, moved laterally over 72 hours before deploying ransomware across 12 hosts.

INC-NE-2026-1130 — Unauthorized Access Dispute. Employee claims they never accessed a restricted file share. HR legal proceeding.

What you will be able to do

1. Interpret every forensic artifact at the binary level. MFT record structures, USN Journal entries, ShellBag shell items, Prefetch file headers, EVTX record format, registry hive cells — you understand what the bytes mean, not just what the tool reports.

2. Detect anti-forensic manipulation. Timestomping through $SI/$FN timestamp comparison. Event log clearing through record ID gap analysis. Prefetch deletion through absence pattern analysis. Registry manipulation through transaction log recovery.

3. Build court-defensible forensic timelines. Multi-artifact super timelines with timestamp correlation, clock skew detection, confidence assessment, and evidence attribution that survives cross-examination.

4. Validate and challenge tool output. When MFTECmd, PECmd, or AmcacheParser produces output, you know what it parsed and whether it parsed it correctly.

5. Produce forensic examination reports. Complete reports with methodology documentation, finding attribution, confidence assessment, and limitation acknowledgment — to the standard required for legal proceedings.

Lab Pack — Hands-On Forensic Analysis Practice

This course includes a production-grade lab pack with two complete forensic scenarios that plant realistic artifacts on your own Windows VM: an insider exfiltration case (INC-NE-2026-0915) and a 72-hour ransomware attack (INC-NE-2026-1022). You capture memory, run KAPE, parse artifacts with the EZ Tools suite, and build court-defensible findings using the same workflow the course teaches. Your VM, your tools, your investigation.

What's included: Two PowerShell artifact generators (Insider and Ransomware), two cleanup scripts, 10 HTML walkthroughs covering MFT through anti-forensics, 30+ practice exercises with hints and expected answers, 10 self-grading verification scripts, 4 court-defensible report templates (examination report, finding documentation, timeline exhibit, QA checklist).

Artifacts planted by the generators: real MFT and USN entries from file copies and mass renames, real Prefetch from implant execution, ShellBags from folder navigation, LNK and Jump Lists from document opens, UserAssist entries, SRUM network telemetry, Event Log entries (4688, 7045, 4104, 1102), USB device registry history, OneDrive personal account configuration, 10 ransomware persistence mechanisms (scheduled tasks, services, Run keys, WMI subscriptions, IFEO hijack), VSS shadow copy for WF08 recovery practice, and Hard mode anti-forensics (timestomping, log clearing, selective Prefetch deletion).

Lab environment (free): Windows 11 VM with 16 GB RAM, PowerShell 5.1+, admin privileges. KAPE and EZ Tools on your analysis workstation. Optional but recommended: Sysmon, Arsenal Image Mounter for VSS work. See the Lab Setup Guide for the complete build.

Forensic workflow covered: Memory acquisition, KAPE triage collection, MFT parsing (MFTECmd), USN Journal analysis, Prefetch (PECmd v31), Amcache, Shimcache, ShellBags (SBECmd), LNK (LECmd), Jump Lists (JLECmd), UserAssist (RECmd), SRUM (SrumECmd), EVTX parsing (EvtxECmd), registry forensics across SYSTEM/SOFTWARE/NTUSER/UsrClass/Amcache hives, VSS shadow copy mounting and recovery, super timeline construction in Timeline Explorer, anti-forensic detection ($SI/$FN mismatch, EventRecordId gap analysis, Prefetch deletion residue), and court-defensible report production.

Scenarios: Insider threat — 6-week data exfiltration by departing engineer, three USB drives, OneDrive personal account, document renaming to disguise proprietary data. Ransomware — REDSTONE affiliate attack chain across three hosts (patient zero DESKTOP-NGE-FIN01 to file server SRV-NGE-FS01), phishing-to-encryption in 72 hours, 10 persistence mechanisms, 500-file rename burst.

What you get that you will not find elsewhere

This is not a tool tutorial. Tool tutorials show you how to run KAPE and read EZ Tools output. This course teaches you what the artifact means at the binary level — so when the tool is wrong, you know.

This is not certification preparation. This course teaches the forensic discipline at examiner depth. Certification syllabi are a separate objective; this course is built for the practitioner who needs to produce court-defensible findings, not pass a multiple-choice exam.

This is written, searchable, and self-paced. Fifteen modules you can read at the workstation, re-read during an investigation, and reference when a client asks how you reached a conclusion. No fixed schedule, no instructor dependency, no time-limited access — you subscribe, you learn at your pace, you come back to the reference when you need it.

Every artifact module includes anti-forensic detection. Other training teaches artifact analysis as if evidence is always pristine. This course teaches you to detect when evidence has been tampered with.

You leave with court-defensible methodology, not just analysis skills. Report templates, finding documentation, methodology descriptions, confidence frameworks, and cross-examination preparation guides.