Triage Image Creation
This episode of “Introduction to Windows Forensics” covers triage image creation. Richard Davis uses FTK Imager …
Cooking with CyberChef
As a continuation of the “Introduction to Windows Forensics” series, this episode looks at CyberChef, a powerful…
Persistence Mechanisms
As a continuation of the “Introduction to Windows Forensics” series by Richard Davis, this episode looks at pers…
Secret Office 365 Activities API
This is a quick look at the recently revealed “activities” API within Office 365. This undocumented interface pr…
RDP Event Log Forensics
As a continuation of the “Introduction to Windows Forensics” series, this episode takes a comprehensive look at …
Windows Process Genealogy
As an incident responder, one of the things you need to be able to quickly do when looking at a list of processes, is immedi…
Event Log Forensics with Log Parser
As a continuation of the “Introduction to Windows Forensics” series, this video introduces Log Parser. This powe…
Introduction to USB Detective
This video is the next episode of “Introduction to Windows Forensics” series by Richard Davis, and introduces US…
Volatility Profiles and Windows 10
As of the recording of this video, the current version of Volatility is 2.6; however, even if you have this version installe…
RDP Cache Forensics
As a continuation of the “Introduction to Windows Forensics” series, this video introduces Remote Desktop Protoc…
