🎯 What You'll Learn
- Apply sound forensic principles
- Analyse key Windows artefacts
- Follow the incident-handling lifecycle
- Document and report incidents
About This Workbook
When prevention fails, investigation begins. This workbook covers digital forensics fundamentals, key Windows artefacts, and the structured incident-handling process from detection to recovery.
Chapter 1 — Forensic Foundations
Principles that keep evidence trustworthy.
- Order of volatility
- Chain of custody
- Acquisition
Chapter 2 — Windows Artefacts
Where the evidence of activity lives.
- Execution artefacts
- File and registry evidence
- Logs
Chapter 3 — The Incident Lifecycle
Handling an incident from start to finish.
- Preparation and detection
- Containment and eradication
- Recovery and lessons learned
Chapter 4 — Reporting
Communicating an investigation clearly.
- Timelines
- Findings
- Incident reports
Keep going. Work through each chapter in order, then apply what you learned in the matching labs.