In this module

Building Your Forensic Analysis Workstation

Module 0 · Free

Operational Objective

Forensic analysis requires a controlled environment. An examiner who analyzes evidence on their daily-use workstation risks contaminating evidence with their own system artifacts, modifying evidence through accidental writes, and mixing investigation data with personal files in a way that violates chain of custody. An examiner who uses a forensic VM without proper configuration risks the VM's antivirus quarantining evidence files, Windows Defender scanning KAPE output and generating false MFT entries, automatic Windows updates modifying the analysis environment mid-examination, and cloud sync services uploading evidence to personal accounts. This subsection provides the complete workstation build for the forensic analysis environment used throughout this course — a Windows 11 VM configured specifically for artifact analysis, with every forensic tool installed, every interference source disabled, and every configuration choice documented for reproducibility.

Deliverable: A fully configured Windows 11 forensic analysis VM with all tools installed (KAPE, EZ Tools suite, Arsenal Image Mounter, FTK Imager, Registry Explorer, Timeline Explorer, HxD, Python), all interference sources disabled (Defender real-time scanning, Windows Update, cloud sync, telemetry), and verification that the workstation does not modify evidence when it is mounted or analyzed.

Estimated completion: 60 minutes (includes VM setup time)

Figure WF0.11 — Forensic analysis workstation layout. The VM platform provides isolation and snapshotting. Forensic tools are pre-installed and verified. Windows features that interfere with evidence analysis are disabled. Evidence handling follows a strict directory structure with read-only mounting and output separation.

VM platform setup

The forensic analysis VM runs on VMware Workstation Pro, which Broadcom made free for personal use in late 2024. VirtualBox is an acceptable alternative if you prefer it — the VM configuration is functionally identical. The host system can be Windows, macOS, or Linux.

Create a new VM with these specifications: 4 vCPU, 8GB RAM (16GB if your host has 32GB+), 120GB virtual disk (thin provisioned), network adapter set to NAT initially (for tool downloads) and then Host-Only or disconnected for analysis. Install Windows 11 Enterprise using the free evaluation ISO from Microsoft's Evaluation Center — the 90-day evaluation is sufficient for training, and you can rearm it or create a new VM when it expires.

During Windows installation: create a local account (not a Microsoft account) named "Analyst" with a known password. Skip all telemetry opt-ins. After installation completes and you reach the desktop, immediately take a snapshot named "Clean Install — Pre-Configuration." This snapshot is your rollback point if the configuration goes wrong.

Expand for Deeper Context

The choice of Windows 11 for the analysis VM is deliberate — it matches the OS on the majority of evidence systems you will encounter. Running your analysis tools on the same OS version as the evidence reduces the risk of version-specific parsing issues (tools compiled for Windows 11 parsing artifacts from Windows 11 evidence). If you regularly analyze evidence from Windows 10 or Windows Server 2022, consider maintaining additional VMs with those OS versions for cases where version-specific testing is needed.

The VM approach has a specific forensic advantage: snapshots provide case isolation. Before starting each investigation, take a snapshot. After the investigation concludes and the report is delivered, revert to the snapshot. This prevents cross-contamination between cases — evidence files, analysis output, and tool artifacts from one investigation do not persist into the next. For practitioners handling multiple concurrent cases, maintain separate snapshots for each case and switch between them as needed.

Disabling interference sources

Windows generates continuous background activity that modifies the filesystem, creates registry entries, and generates Event Log entries. On a daily-use workstation, this is normal operation. On a forensic analysis VM, it is noise that can contaminate evidence and confuse analysis. Disable the following:

Windows Defender real-time protection. Defender will scan evidence files — including malware samples in KAPE collections, malicious executables in forensic images, and Amcache entries containing known-malicious SHA1 hashes. Scanning can quarantine evidence files, modify the MFT (by moving files to quarantine), and generate false-positive alerts. Open Windows Security → Virus & threat protection → Manage settings → disable Real-time protection. On Windows 11, this will re-enable after a period — for a persistent disable, use Group Policy: Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Turn off Microsoft Defender Antivirus → Enabled.

Windows Update automatic downloads. Updates modify system files, create Prefetch entries, generate Event Log entries, and may reboot the VM mid-analysis. Open Settings → Windows Update → Pause updates for the maximum period. For persistent control: Group Policy → Computer Configuration → Administrative Templates → Windows Components → Windows Update → Configure Automatic Updates → Disabled.

OneDrive and cloud sync. OneDrive syncs files in the user profile to Microsoft's cloud — if evidence files are placed in a synced folder, they are uploaded. Uninstall OneDrive or at minimum sign out and disable startup.

Windows Search indexing. The indexing service scans file contents and creates database entries — this activity modifies the MFT and generates USN Journal entries for the index database files. Open Services (services.msc) → Windows Search → Stop → set Startup type to Disabled.

SysMain (Superfetch/Prefetch service). On the analysis VM, you don't need Prefetch optimization — and the service generates its own artifacts that could be confused with evidence artifacts. Open Services → SysMain → Stop → Disabled.

Diagnostic data and telemetry. Settings → Privacy & Security → Diagnostics & feedback → set Diagnostic data to Required (minimum). Group Policy → Computer Configuration → Administrative Templates → Windows Components → Data Collection and Preview Builds → Allow Diagnostic Data → Disabled or Diagnostic data off.

Decision point

You are configuring your analysis VM and need to decide: should you install forensic tools on the host OS or inside a VM? The host OS gives better performance (direct hardware access, no virtualization overhead). The VM provides isolation (the analysis environment is separate from your personal/work environment).

Your options: (A) Install on the host for performance — forensic analysis of large MFT files and disk images benefits from direct disk I/O. (B) Use a dedicated VM for every case. The VM provides: isolation (evidence from one case cannot contaminate another), snapshotting (save the VM state before analysis, restore if something goes wrong), portability (move the VM to a different machine), and defensibility (you can testify that the analysis environment was clean — snapshot shows the VM state before evidence was loaded). The performance cost is minimal for most analysis tasks. Only full disk imaging and memory analysis of very large captures benefit significantly from host-level performance.

The correct approach is B for defensibility. Take a snapshot of the clean VM before loading evidence for each case. This provides a verifiable baseline that proves your analysis environment didn't contain artifacts from previous cases.

Try It — Configure Your Analysis VM

Follow this checklist to configure your forensic analysis VM. Check each item after completion:

VM creation: - [ ] VMware Workstation Pro (or VirtualBox) installed on host - [ ] New VM: 4 vCPU, 8GB RAM, 120GB thin-provisioned disk - [ ] Windows 11 Enterprise evaluation installed - [ ] Local account "Analyst" created (no Microsoft account) - [ ] "Clean Install" snapshot taken

Interference disabled: - [ ] Defender real-time protection off (via Group Policy for persistence) - [ ] Windows Update paused or disabled - [ ] OneDrive uninstalled or signed out - [ ] Windows Search service stopped and disabled - [ ] SysMain service stopped and disabled - [ ] Diagnostic data set to minimum/disabled

Directory structure created: - [ ] C:\Tools\ — all forensic tools - [ ] C:\Tools\KAPE\ — KAPE with targets and modules - [ ] C:\Tools\EZTools\ — full EZ Tools suite - [ ] C:\Cases\ — per-case working directory - [ ] Evidence mount point configured (D:\ or E:\)

Tools installed and verified: - [ ] KAPE (latest from kape.sh) — run kape.exe --help to verify - [ ] EZ Tools (download all from ericzimmerman.github.io) — run MFTECmd with --help - [ ] Arsenal Image Mounter (arsenalrecon.com) — install and verify - [ ] FTK Imager (exterro.com) — install and verify - [ ] Registry Explorer — open and verify hive loading - [ ] Timeline Explorer — open and verify CSV loading - [ ] HxD (mh-nexus.de) — install - [ ] Python 3.12 (python.org) — verify with python --version

"Configured Workstation" snapshot taken — this is your analysis-ready baseline.

Tool installation

All tools used in this course are free. Create a C:\Tools\ directory and install each tool suite in its own subdirectory.

KAPE — download from kape.sh (requires a free account). Extract to C:\Tools\KAPE\. Run kape.exe --help to verify. KAPE includes both targets (what to collect) and modules (how to process). Update targets and modules with C:\Tools\KAPE\Get-KAPEUpdate.ps1.

Eric Zimmerman's Tools — download from ericzimmerman.github.io/#!index.md. Use the "Download All" batch file or download individually. Extract to C:\Tools\EZTools\. The suite includes: MFTECmd, PECmd, AmcacheParser, ShimCacheParser, AppCompatCacheParser, JLECmd, LECmd, SBECmd, RECmd, EvtxECmd, SrumECmd, RBCmd, WxTCmd, bstrings, and more. Verify each tool runs with --help.

Arsenal Image Mounter — download from arsenalrecon.com. The free version mounts forensic images (E01, raw, VMDK) as read-only Windows drives. This is how you access evidence from forensic images without modifying the image.

FTK Imager — download from exterro.com (free registration required). Used for creating forensic images and extracting files from images. Install with default settings.

Registry Explorer and RECmd — included in the EZ Tools download. Registry Explorer provides GUI-based registry hive analysis with deleted key recovery and transaction log application. RECmd provides command-line batch processing.

Timeline Explorer — included in the EZ Tools download. A specialized CSV viewer designed for forensic timeline data — handles millions of rows, provides conditional formatting, column filtering, and bookmarking.

HxD — download from mh-nexus.de/en/hxd/. A free hex editor used for raw artifact examination throughout this course.

Python 3.12 — download from python.org. Install with "Add to PATH" checked. After installation, install forensic libraries: pip install python-registry yara-python pefile construct.

Evidence handling procedures

Evidence integrity depends on consistent handling procedures. The analysis VM uses this structure:

C:\Cases\{CaseID}\ — one directory per investigation. Under each case directory: evidence\ (original evidence files — KAPE collections, forensic images, copied artifacts), output\ (tool processing output — MFTECmd CSVs, parsed registry data, timeline files), notes\ (examination notes, screenshots, working documentation), and report\ (final deliverables).

When mounting a forensic image: always use Arsenal Image Mounter in read-only mode. Verify the image hash before mounting (compare against the hash recorded at acquisition). After mounting, the image appears as a Windows drive letter — you can browse the filesystem and extract files, but you cannot modify the image contents.

When processing with KAPE or EZ Tools: output always goes to the output\ directory within the case folder, never to the evidence directory. This separation ensures that tool output (which is generated by the analysis process) is physically separated from original evidence (which must remain unmodified).

Compliance Myth: "Any clean Windows VM is suitable for forensic analysis"

The myth: Forensic tools run on any Windows system. Install the tools on your daily workstation or a standard VM and start analyzing. The tools handle evidence integrity — that's what write-blocking and hash verification are for.

The reality: Write-blocking and hash verification protect the original evidence from modification. They do not protect the analysis environment from contaminating the analysis output. A daily-use workstation has thousands of Prefetch files, millions of MFT records, and years of registry history — if the examiner accidentally processes their own system's artifacts alongside the evidence, the analysis is contaminated. Windows Defender on an unconfigured VM will quarantine malware samples from evidence, generating its own MFT entries and Event Log records that interleave with analysis output. Windows Update running during analysis creates filesystem activity that could be confused with evidence processing. A purpose-built forensic VM with interference disabled, a clean directory structure, and case-level snapshots prevents these contamination vectors.

Troubleshooting

"The Windows 11 evaluation expires after 90 days." You have several options: rearm the evaluation with slmgr /rearm (available 1-2 times, extending by 90 days each), create a new VM from a fresh evaluation ISO, or purchase a Windows 11 Pro license (approximately $30 from authorized resellers). For training purposes, the evaluation is sufficient — you can complete this course well within the evaluation period.

"I don't have enough disk space for a 120GB VM plus evidence files." The 120GB VM disk is thin-provisioned — it only uses actual space as data is written, starting around 25-30GB after OS installation and tools. Evidence files are the larger concern: a single KAPE triage collection is typically 2-10GB, and a full disk image is 100GB+. Store evidence files on an external drive connected to the host, accessible to the VM via a shared folder or USB passthrough. This keeps the VM disk lean while providing abundant evidence storage.

"Should I use a physical forensic workstation instead of a VM?" For production forensic work (real investigations), many practitioners use dedicated physical workstations for performance and to avoid virtualization-related complications. For training and learning, a VM is preferable: snapshots provide case isolation, the environment is disposable and reproducible, and you can run the VM alongside your notes and browser on the host. The artifact analysis techniques are identical regardless of whether you run the tools in a VM or on bare metal.

Operational Artifact — Forensic Workstation Verification Checklist

Run this verification after configuring your analysis VM and before analyzing any evidence. 1. Defender status: Open PowerShell, run Get-MpPreference | Select-Object DisableRealtimeMonitoring — should return True. If False, Defender will scan and potentially quarantine evidence. 2. Windows Update status: Run Get-Service wuauserv | Select-Object Status — should return Stopped. 3. Search indexing status: Run Get-Service WSearch | Select-Object Status — should return Stopped. 4. SysMain status: Run Get-Service SysMain | Select-Object Status — should return Stopped. 5. Write-block verification: Mount a test forensic image read-only via Arsenal Image Mounter. Check the drive properties — it should show as read-only. Attempt to create a file on the mounted drive — it should fail with an access denied error. 6. Tool verification: Run MFTECmd.exe --help — should display help text without errors. Run PECmd.exe --help. Run Registry Explorer — should open without errors. 7. Directory structure: Verify C:\Cases\ and C:\Tools\ exist. 8. Take snapshot: Name it "Verified Analysis Workstation — [date]". This is your analysis-ready baseline for all investigations in this course.

You have configured your forensic analysis VM but forgot to disable Windows Defender real-time protection. You mount a forensic image from a ransomware investigation and begin processing with KAPE modules. Defender detects the ransomware executable in the mounted image and quarantines it. What is the impact on your analysis and what should you do?

No impact — the forensic image is read-only, so Defender cannot modify it. The quarantine action is blocked by the write-protection. The ransomware executable is still accessible in the mounted image for analysis.

The forensic image itself is protected by read-only mounting, but the KAPE module output may be affected. If KAPE extracted the ransomware executable to the output directory for processing, Defender may have quarantined the extracted copy — removing it from the output and adding Defender quarantine entries to the analysis VM's own Event Logs and MFT. Additionally, Defender's scan of the mounted image generated filesystem access activity on the analysis VM (Event Log entries, possible Prefetch for MsMpEng.exe scanning operations). The analysis VM's own artifacts are now contaminated with Defender activity. Restore the VM to the pre-analysis snapshot, disable Defender, and reprocess the evidence from the clean state.

Critical impact — Defender has modified the forensic image by quarantining the ransomware executable. The image hash will no longer match the acquisition hash, and the evidence chain is broken. The image must be re-acquired from the original source.

Minor impact — restore the quarantined file from Defender's quarantine and continue analysis. Document the quarantine event in your examination notes. The file content is unchanged in quarantine, so the analysis can proceed normally after restoration.

You've built the foundations of artifact-level forensic analysis.

WF0 gave you the taxonomy, NTFS architecture, and the five-step methodology. WF1 took you inside the MFT at the binary level — every attribute, every timestamp, every edge case. From here, every artifact category gets the same raw-first treatment.

WF2–WF10: every major Windows artifact decoded at binary level — USN Journal, Prefetch, Amcache, Shimcache, ShellBags, LNK, Jump Lists, SRUM, Event Logs, and the Registry hives
INC-NE-2026-0915 (WF13) — Insider data exfiltration capstone. Work the complete investigation from USB history to OneDrive exfiltration evidence
INC-NE-2026-1022 (WF14) — Ransomware capstone. Three-host triage (FIN01 → IT03 → FS01) across the 72-hour attack chain
The lab pack — 25+ realistic evidence files in 10 formats, simulated KAPE triage pre-populated, both capstones deployable to your own VM
Anti-forensic detection methodology — defeat timestomping, log clearing, and Prefetch deletion with cross-artifact correlation

Unlock with Specialist — £25/mo See Full Syllabus

Cancel anytime

← Previous Next →