This course is designed to provide local/federal law enforcement, military investigative personnel, and private sector security professionals training on the knowledge and skills required to leverage Windows resources and artifacts to perform a comprehensive timeline-based examination.

During course activities and exercises, participants will demonstrate the ability to perform forensically sound investigations and efficiently analyze digital artifacts pertaining to items of evidentiary value. Upon completion of this course, participants will be able to draft an effective report on findings detailing the analysis process followed to locate pertinent evidence.