Windows System Forensics

Catalog description

This course is designed to provide students with the ability to identify and employ forensics techniques for gathering, preserving and analyzing evidence on Windows systems, and to report the pertinent evidence to the courts. The course emphasizes both the fundamental computer forensics procedures and the hands-on experience of utilizing the Windows forensics tools to uncover pertinent evidence from memory, allocated and unallocated space, and other Windows artifacts including registry, recycle bin, Internet Explorer, emails, etc. Students will also follow and practice the forensics-sound procedures to ensure evidence admissibility in court.