Curriculum
Course Content
4 items · 1 sections
- 01 Forensically valuable registry keys
- 02 Execution and persistence evidence
- 03 User-activity artefacts
- 04 Registry evidence to a timeline
GCFA
Advanced
Certificate
Registry and Artifact Analysis
The Windows registry as an evidence store. The keys that record execution, persistence and user activity, and reading them into the record of what an attacker did.
Skills
What You Will Learn in This Course
Analyse the forensically valuable registry keys.
Recover execution and persistence evidence.
Read user-activity artefacts.
Tie registry evidence to a timeline.
About This Course
The Windows registry as an evidence store. The keys that record execution, persistence and user activity, and reading them into the record of what an attacker did.
Requirements
- Windows forensics.
Who It Is For
- GCFA-track analysts.
Certified
Certificates You Can Earn
Finish your course and receive an accredited MotiGraph certificate you can add to your CV and share with employers.
