* Cantinho Satkeys

Refresh History
  • j.s.: bom fim de semana  43e5r6 49E09B4F
    Hoje às 08:37
  • j.s.: ghyt74 a todos  4tj97u<z
    Hoje às 08:36
  • FELISCUNHA: ghyt74   49E09B4F  e bom feriado   4tj97u<z
    01 de Novembro de 2024, 10:39
  • JPratas: try65hytr Pessoal  h7ft6l k7y8j0
    01 de Novembro de 2024, 03:51
  • j.s.: try65hytr a todos  4tj97u<z
    30 de Outubro de 2024, 21:00
  • JPratas: dgtgtr Pessoal  4tj97u<z k7y8j0
    28 de Outubro de 2024, 17:35
  • FELISCUNHA: Votos de um santo domingo para todo o auditório  k8h9m
    27 de Outubro de 2024, 11:21
  • j.s.: bom fim de semana   49E09B4F 49E09B4F
    26 de Outubro de 2024, 17:06
  • j.s.: dgtgtr a todos  4tj97u<z
    26 de Outubro de 2024, 17:06
  • FELISCUNHA: ghyt74   49E09B4F  e bom fim de semana
    26 de Outubro de 2024, 11:49
  • JPratas: try65hytr Pessoal  101yd91 k7y8j0
    25 de Outubro de 2024, 03:53
  • JPratas: dgtgtr A Todos  4tj97u<z 2dgh8i k7y8j0
    23 de Outubro de 2024, 16:31
  • FELISCUNHA: ghyt74  pessoal   49E09B4F
    23 de Outubro de 2024, 10:59
  • j.s.: dgtgtr a todos  4tj97u<z
    22 de Outubro de 2024, 18:16
  • j.s.: dgtgtr a todos  4tj97u<z
    20 de Outubro de 2024, 15:04
  • FELISCUNHA: Votos de um santo domingo para todo o auditório  101041
    20 de Outubro de 2024, 11:37
  • axlpoa: hi
    19 de Outubro de 2024, 22:24
  • FELISCUNHA: ghyt74   49E09B4F  e bom fim de semana  4tj97u<z
    19 de Outubro de 2024, 11:31
  • j.s.: ghyt74 a todos  4tj97u<z
    18 de Outubro de 2024, 09:33
  • JPratas: try65hytr Pessoal  4tj97u<z classic k7y8j0
    18 de Outubro de 2024, 03:28

Autor Tópico: Surviving Digital Forensics: Windows Shellbags  (Lida 82 vezes)

0 Membros e 1 Visitante estão a ver este tópico.

Online mitsumi

  • Moderador Global
  • ***
  • Mensagens: 115487
  • Karma: +0/-0
Surviving Digital Forensics: Windows Shellbags
« em: 28 de Agosto de 2020, 12:27 »

Surviving Digital Forensics: Windows Shellbags
Duration: 1h9m | .MP4 1280x720, 30 fps(r) | AAC, 44100 Hz, 2ch | 257 MB
Genre: eLearning | Language: English
Computer forensic evidence to help prove file use & knowledge

What you'll learn
Extract and analyze windows shellbag records to help prove file use and knowledge
Use freely available forensic tools to conduct shellbag analysis
Construct validation exercises to test how shellbags behave depending on media type
Construct validation exercises to test how shellbags behave according to different types of user activity
Confidently explain what Windows shellbag evidence is to non-technical audiences

Requirements
You need a PC running Win7 or Win8 with admin rights
All forensic tools used are freely available,  are included
Your test system should contain no critical data

Description
  Welcome to the Surviving Digital Forensics series. This series is focused on helping you become a better computer forensic examiner by teaching core computer forensic skills - all in about one hour. In this class examine how to use Windows Shellbag records to help prove file use and knowledge.  Shellbag records are created by certain user activity and can be used to show where a user has navigated to on a computer system and when they did so.  Very powerful evidence! 
  As with previous SDF classes you will learn by doing. The class begins with a brief overview of the issue at hand. Then we set up our forensic systems and off we go. Learning is hands on and we will use low cost and no cost computer forensic tools to do so. 
  Expert and novice computer forensic examiners alike will gain from this class. Since we are doing it the SDF way we are going to teach you real computer forensic skills that you can apply using our method or customize to meet your needs. You will learn how you can use freely available forensic tools, all GUI based, to extract and analyze Windows Shellbag evidence. 
  Class Outline 
  1. Introduction and Welcome to the SDF series 
  2. Getting the most out of the class 
  3. Windows Shellbags - an overview 
  5. Shellbag Deep Dive 
  6. Setting up your forensic system 
  7. Validation practical 01 - local system activity 
  8. Validation practical 02 - attached USBs 
  9. Validation practical 03 - networked drives 
  10. Student Practical 
  11. Student Quiz 
  12. Reporting options 
  13. Review 
  14. Conclusion & thank you 
  A PC running Win7 or Win8 is required for this course. You need admin rights to the system.  The system itself should be a test system containing no critical data.  The forensic tools we use are all freely available, so beyond your operating system all you need is the desire to become a better computer forensic examiner. 

Who this course is                                                                                                                                                                                                       for:
Computer Forensic Analysts
IT Professionals
Students

Download link:
Só visivel para registados e com resposta ao tópico.

Only visible to registered and with a reply to the topic.

Links are Interchangeable - No Password - Single Extraction