DFIR - Windows Forensics - Part 1

preview_player
Показать описание
In this DFIR exercise on Lets Defend, we are supplied an AD1 file to mount with FTK Imager and use Eric Zimmerman's tools to analyze, investigate and 10 questions to answer!

Due to length and issues around Q4, I have decided to make this a 2 part-er (hopefully just a 2 part-er!)

*Make sure to use FTK Imager 4.7.1.2+ to mount the AD1 file

MD5: 5707aa9987086320e214b7b5cd1334e4
SHA-1: 605301a3dc6e4a27e7cbd1092eb3daf253604aef
SHA-256: 743665e2a1836451ce851eef6b1841cd668e15f867d84dcefdd8636959373c99

  1. InfoSec_Bret
  2. SOC
  3. SOC Analyst
  4. SOC Engineer
  5. Lets Defend
  6. Blue Team
Рекомендации по теме
DFIR - Windows 1:25:20

DFIR - Windows Forensics - Part 1

DFIR - Windows 0:38:53

DFIR - Windows Forensics - Part 2

Intro to Windows 0:34:49

Intro to Windows Forensics: Windows Registry Artifacts - TryHackMe Walkthrough

Windows 8 SRUM 0:53:50

Windows 8 SRUM Forensics - SANS DFIR Summit 2015

Windows Forensics Training 0:01:21

Windows Forensics Training Course - SANS Institute - DFIR - FOR408 - Rob Lee

DFIR 101: Digital 1:16:05

DFIR 101: Digital Forensics Essentials | Kathryn Hedley

Become a Cyber 0:16:04

Become a Cyber Forensic Investigator (Beginners DFIR Roadmap 2025)

Introduction to Windows 1:04:33

Introduction to Windows Forensics

BitLocker Encryption 0:18:01

BitLocker Encryption

Windows Forensics: Event 0:29:24

Windows Forensics: Event Trace Logs - SANS DFIR Summit 2018

DFIR (Windows Forensics) 0:10:00

DFIR (Windows Forensics) Course: Data Recovery

Free DFIR Training: 0:00:54

Free DFIR Training: Windows Forensics with Belkasoft

Introduction to Windows 0:02:32

Introduction to Windows Forensics

Introduction to Digital 0:22:03

Introduction to Digital Forensics and Incident Response | TryHackMe DFIR

Introduction to Windows 0:38:52

Introduction to Windows Forensics | Webinar | Digital Forensics | #cybersecurity #digitalforensics

Windows Forensics FOR500 0:01:46

Windows Forensics FOR500 (formerly FOR408) Rob Lee

How to Analyse 0:28:16

How to Analyse a Windows 10 Workstation for Digital Forensics

Windows Phone 8 0:44:15

Windows Phone 8 Forensic Artifacts and Case Study - DFIR Summit 2015

SOC Lvl 1 0:21:56

SOC Lvl 1 / EP.35 / Digital Forensics Intro / Incident Response Intro With DFIR Tools

DFIR (Windows Forensics) 0:17:49

DFIR (Windows Forensics) Course: Exploring offline Registry hives using the 'Registry Explorer&...

Windows Forensics Part 0:36:15

Windows Forensics Part 1 | Registry Forensics | TryHackMe

DFIR (Windows Forensics) 0:23:54

DFIR (Windows Forensics) Course: Collecting Network info from Registry hives

FOR500: Windows Forensic 0:00:29

FOR500: Windows Forensic Analysis course: What to expect

The Windows Forensics 0:05:57

The Windows Forensics tools you need to learn and master