GCFA prep
Advanced
Advanced Incident Response & Threat Hunting
Investigate enterprise intrusions with memory forensics, timelines and threat hunting, and prepare for the GIAC GCFA exam.
Fees on request
Details
← All courses
Intermediate
Windows Forensic Analysis
Examine Windows systems to reconstruct user and attacker activity, and prepare for the GIAC GCFE exam.
This course prepares you for the GIAC GCFE exam objectives. iSecRadar is not affiliated with, sponsored by or endorsed by GIAC or the SANS Institute. GCFE is a certification of GIAC, and exam registration is completed directly with GIAC.
About the Windows Forensic Analysis course
Windows Forensic Analysis teaches you to examine Windows computers and answer the questions investigations depend on: who did what, when, and with which files and programs. You work with real artifact types, including the registry, file system metadata, event logs and browser history.
The course follows the GIAC Certified Forensic Examiner (GCFE) exam objectives and emphasizes evidence handling that stands up to internal, legal and regulatory review.
Who this course is for
- Digital forensic examiners and investigators
- Incident responders who need deeper host analysis skills
- Internal investigation, audit and HR investigation teams
- Law enforcement and legal support professionals
Prerequisites
- Good working knowledge of Windows
- Basic security concepts
- Incident Handling & Attacker Techniques or equivalent experience helpful
What you'll learn
- Acquire and preserve Windows evidence with sound forensic methods
- Analyze registry, file system and event log artifacts
- Reconstruct user activity, file access and program execution
- Prepare for the GCFE exam objectives
Syllabus
- Forensic process, evidence handling and chain of custody
- Disk imaging and triage collection
- Registry analysis and user activity artifacts
- File system timelines and deleted data
- Event logs, browser and email artifacts
- Reporting and exam objectives review
Hands-on labs and exercises
- Acquire disk images and verify integrity with hashes
- Parse registry hives to reconstruct user activity
- Build a file system and event log timeline
- Investigate data access and USB device usage
- Write a forensic findings report
Where this course takes you
- Digital forensic analyst and examiner roles
- Internal investigations and e-discovery support
- Next step toward Advanced Incident Response & Threat Hunting
Included
- Live sessions with session recordings
- Guided lab environment
- Certificate of completion
- Community and instructor Q&A
Windows Forensic Analysis: frequently asked questions
What is the GCFE certification?
GCFE (GIAC Certified Forensic Examiner) is a GIAC certification focused on Windows forensic analysis, including collecting and analyzing data from Windows systems.
Is this an official GIAC or SANS course?
No. iSecRadar is not affiliated with GIAC or SANS. The course is independent training aligned with the published GCFE exam objectives.
What is the difference between GCFE and GCFA preparation?
Windows Forensic Analysis (GCFE) focuses on user activity and core Windows artifacts. Advanced Incident Response & Threat Hunting (GCFA) focuses on intrusion investigations, memory forensics and attacker activity across an enterprise.
Keep learning
Recommended next courses
GNFA prep
Advanced
Network Forensics & Analysis
Investigate attacks using packet captures, flow data and network logs, and prepare for the GIAC GNFA exam.
Fees on request
Details