BEC102 Advanced Computer-based Investigations Course


Price: $1450 USD

Location: Online

More Info

This course is designed to provide local/federal law enforcement, military investigative personnel, and private sector security professionals training on the knowledge and skills required to leverage Windows resources and artifacts to perform a comprehensive timeline-based examination.

During course activities and exercises, participants will demonstrate the ability to perform forensically sound investigations and efficiently analyze digital artifacts pertaining to items of evidentiary value. Upon completion of this course, participants will be able to draft an effective report on findings detailing the analysis process followed to locate pertinent evidence.


Language: English

Duration: 2 days

Formats: Onsite or online


  1. Introduction 1 Hour
  2. The Case Jacket 1 Hour
  3. Windows Registry Artifacts 2 Hours
  4. Parsing Windows Prefetch 1 Hour
  5. Parsing Link Files 1 Hour
  6. Windows 10 Timeline and Event Logs 2 Hours
  7. Understanding Metadata 1 Hour
  8. Final Practical 3 Hours