Windows OS Forensics

Module 1 delves into the fundamental concepts of bits, bytes, and endianness, providing a comprehensive understanding of converting decimal to binary, binary to hex, signed integers, and the differences between little endian and big endian.

Module 2 explores the disk partition schema, distinguishing between physical and logical drives, sectors and clusters, MBR and GPT partition schema, and solid-state disks, offering a detailed insight into the structure of storage devices.

Module 3 focuses on the FAT file system, covering its overview, volume boot record, root directory, FAT table, file creation and deletion, and file recovery, providing a comprehensive understanding of the FAT file system's functionality and recovery processes.

Module 4 delves into the NTFS file system, addressing its overview, volume boot record, master file table, data runs, creation and deletion of files, and file recovery, offering an in-depth insight into the NTFS file system's structure and file management processes.

Module 5 provides a comprehensive overview of the ex-fat file system, including its history, volume boot record, root directory, file creation and deletion, and file recovery, enabling students to understand the functionality and recovery processes of the ex-fat file system.

Module 6 explores Windows registry forensics, covering its overview, live registry, location of registry files within an image file, common forensics artifacts found in the registry, and a Windows OS Forensics quiz, offering a detailed insight into Windows registry forensics and forensic artifacts.