You cannot protect what you do not know, and understanding forensic capabilities and artefacts is a fundamental cog of information security. This course centres on building in-depth digital forensics knowledge of Microsoft Windows operating systems. You will learn how to recover, analyse, and substantiate forensic data on Windows systems, track particular user activity on your network, and organize findings for use in incident response, internal investigations, and civil/criminal proceedings. You will be able to use your new skills to validate security tools, enhance vulnerability assessments, identify insider threats, track hackers, and improve security policies.