Windows Forensics and Advanced NTFS Investigation Course – London, 11–15 Oct 2027

Reconstruct activity on a Windows workstation

A one-week investigation workshop for digital forensic examiners, incident responders, and security analysts. Work from a fictional case file and a prepared disk image. Each exercise asks what the evidence supports, what could explain it differently, and what you would collect next. Familiarity with Windows administration and filesystem basics is helpful.

What you will be able to do

• Preserve a disk image and record how evidence was handled.
• Connect NTFS metadata to actions on files and directories.
• Correlate Windows artifacts while accounting for timestamp differences.
• Write findings another examiner can reproduce.

One-week agenda

1. Scope a suspected data transfer. Record collection decisions, verify hashes, mount a working copy read-only, and set up an evidence log.
2. Trace file changes using the Master File Table, directory entries, and the USN change journal. Compare rename, move, and deletion evidence and flag gaps caused by retention.
3. Test a hypothesis about program execution and removable storage. Compare event logs, Registry data, shortcut files, and execution artifacts against known lab actions.
4. Build a timeline from multiple sources. Normalize timestamps, investigate conflicts, and distinguish a documented artifact from an inference about the user.
5. Review the case as a team. Hand over an evidence index, a reproducible timeline, and a concise report that separates findings, limitations, and follow-up questions.

Assessment

The instructor reviews lab results and the final handover with participants, focusing on evidence quality, clarity of decisions, and reproducibility.