Protect the evidence.
Understand acquisition choices, hashes, working copies, and the notes that make an investigation repeatable.
MASTERCLASS 02 · FREE · ON DEMAND
Digital Forensics
Operations
Investigating Windows Evidence with Ubuntu
Watch a forensic investigation unfold as we examine Windows memory, disk artifacts, and event logs from Ubuntu. Follow the instructor-led recording and learn how evidence supports each conclusion.
CASE FILE / 002FOLLOW THE EVIDENCE
MEMORYDISKREGISTRYTIMELINE
FORMATOn-demand recordingPause, replay and learn at your pace
TOPICWindows evidenceInstructor-led investigation from Ubuntu
ACCESSFree to watchNo registration required · English
FREE MASTERCLASS · ON DEMAND
Watch. Learn. Revisit.
Digital Forensics Operations
Investigating Windows Evidence with UbuntuNo registration required. Playing the video connects to YouTube.
LESS GUESSWORK. BETTER QUESTIONS.
Turn scattered traces
into a supported story.
Follow a case-based walkthrough of the analyst’s process. Learn what the evidence supports, what it does not, and where to investigate next.
Find the useful traces.
Examine processes, network connections, filesystem activity, Prefetch, event logs, and Registry artifacts.
Build the timeline.
Correlate sources, normalize timestamps, and distinguish an observation from an assumption.
Make findings useful.
Summarize the sequence of events, record confidence and gaps, and identify the next evidence to collect.
SESSION TOPICS
One case.
Follow every lead.
Explore the investigation topics covered by the masterclass. Use the YouTube player to pause and revisit sections.
The case & evidence handling
Frame the investigation, preserve integrity, and record acquisition decisions.
Memory tells the first story
Inspect process relationships and network artifacts to develop leads.
Follow the trail on disk
Connect filesystem timestamps, browser traces, Prefetch, and Windows event logs.
Registry clues & the timeline
Examine persistence and user activity artifacts. Correlate the findings across sources.
Findings and next steps
Explain the findings, document uncertainty, and identify the next evidence to collect.
IS THIS FOR YOU?
Curiosity required.
Expert status optional.
This session is designed for SOC analysts, IT professionals, incident responders, and learners building a foundation in digital forensics.
- Basic familiarity with Windows and command-line concepts will help.
- The instructor performs the lab on Ubuntu while you follow the recorded investigation. No installation is required.
- We focus on investigation and interpretation. This is not a full certification course.
Curriculum reference: ENISA, Forensic analysis: Local Incident Response, teacher handbook (2016). This independent Iron Fist Labs session adapts selected investigation topics; it is not affiliated with or endorsed by ENISA.
ABOUT THE RECORDING
A few practical details.
Is the recording free?
Yes. Watch the masterclass here or on YouTube without registering.
Do I need to install any tools?
No installation is required to watch. The instructor demonstrates the investigation using Ubuntu.
Can I pause and revisit sections?
Yes. Use the YouTube player controls to pause, seek and replay the recording.
Where can I find more masterclasses?
Explore our Events page and follow Iron Fist Labs on YouTube for more cybersecurity training.
KEEP EXPLORING