Protect the evidence.
Understand acquisition choices, hashes, working copies, and the notes that make an investigation repeatable.
MASTERCLASS 02 · FREE · LIVE ONLINE
Digital Forensics
Operations
Investigating Windows Evidence with Ubuntu
Watch a forensic investigation unfold as we examine Windows memory, disk artifacts, and event logs from Ubuntu. Learn how evidence supports the conclusion in this free three-hour instructor demonstration and live Q&A.
CASE FILE / 002FOLLOW THE EVIDENCE
MEMORYDISKREGISTRYTIMELINE
WHENSaturday, October 1011 AM Eastern / 8 AM Pacific / 3 PM UTC
DURATION3 hoursGuided investigation, break & Q&A
ACCESSFree registrationGoogle Meet · Session delivered in English
LESS GUESSWORK. BETTER QUESTIONS.
Turn scattered traces
into a supported story.
Follow a case-based walkthrough of the analyst’s process. Learn what the evidence supports, what it does not, and where to investigate next.
Find the useful traces.
Examine processes, network connections, filesystem activity, Prefetch, event logs, and Registry artifacts.
Build the timeline.
Correlate sources, normalize timestamps, and distinguish an observation from an assumption.
Make findings useful.
Summarize the sequence of events, record confidence and gaps, and identify the next evidence to collect.
YOUR THREE HOURS
One case.
Follow every lead.
A focused introduction to Windows incident investigation, with time to ask questions. All times are Eastern.
The case & evidence handling
Frame the investigation, preserve integrity, and record acquisition decisions.
Memory tells the first story
Inspect process relationships and network artifacts to develop leads.
Follow the trail on disk
Connect filesystem timestamps, browser traces, Prefetch, and Windows event logs.
Short break
Step away, then return for the final part of the investigation.
Registry clues & the timeline
Examine persistence and user activity artifacts. Correlate the findings across sources.
Findings, next steps & live Q&A
Explain what happened, document uncertainty, and discuss your questions.
IS THIS FOR YOU?
Curiosity required.
Expert status optional.
This session is designed for SOC analysts, IT professionals, incident responders, and learners building a foundation in digital forensics.
- Basic familiarity with Windows and command-line concepts will help.
- The instructor performs the lab on Ubuntu while you watch, discuss evidence, and ask questions. No installation is required.
- We focus on investigation and interpretation. This is not a full certification course.
Curriculum reference: ENISA, Forensic analysis: Local Incident Response, teacher handbook (2016). This independent Iron Fist Labs session adapts selected investigation topics; it is not affiliated with or endorsed by ENISA.
FREE MASTERCLASS · OCTOBER 10
Bring your curiosity.
Follow the evidence.
Register for the instructor-led session. Confirmed attendees receive joining details and a calendar invitation by email. Once attendee places are filled, further registrations join the waitlist.
Digital Forensics Operations
Saturday, October 10, 2026
11:00 AM–2:00 PM Eastern Time
Google Meet · Free
Confirmation and joining details will be emailed from info@ironfistlabs.com. Places are limited; further registrations join the waitlist.
BEFORE YOU JOIN
A few practical details.
Is the masterclass really free?
Yes. There is no fee to attend and no purchase is required.
Do I need to install any tools?
You can follow the guided walkthrough without installing tools. Any optional preparation instructions will be shared before the event.
How do I receive the joining link?
Confirmed attendees receive the Google Meet link, dial-in instructions, and a calendar invitation by email. If the session is full, you will receive a waitlist notice and joining details when a place becomes available.
Will there be a recording or certificate?
Recording availability and certificates have not been confirmed. Register for the live session; any updates will be included in event communications.
Will registering subscribe me to marketing emails?
Only if you select the optional updates checkbox. Registration communications are separate from future marketing updates.
KEEP EXPLORING