13 modules
Windows Forensic Examiner
One fictional company, Calder Logistics, and four connected matters an examiner would actually be handed: a departing employee suspected of taking customer data (Matter A), a harassment complaint between two staff (Matter B), an unauthorized-software policy violation on a shared workstation (Matter C), and a contested logon where an employee says "I was not at my desk" (Matter D). Every module opens on a question from one of these matters and ends in a deliverable. The order is the order an examination runs.
- Who it is for
- security analysts, IT staff handed their first internal investigation, and law enforcement and legal professionals who need to examine Windows systems.
- Prerequisites
- comfort with Windows administration and a command line; no prior forensics required.
- Time
- 13 modules, 2 to 4 hours each, planning estimate.
- Status
- First modules December 14, 2026. Module 00 is free on release.
Thirteen modules. Evidence you can defend.
Each module opens on a case question and ends in a deliverable. On smaller screens, scroll the tables horizontally to read every column.
| # | Module | Opens on | You build | Lab on SIFT | Hours | Status |
|---|---|---|---|---|---|---|
| 00 | The first hour of a case | HR calls: a sales director resigned Friday; legal wants her laptop looked at Monday | An intake memo: questions, scope, legal holds, what to preserve and in what order | Yes: Calder Logistics synthetic set. Hash and mount a provided image read-only; start a case log | 2 to 4, planning estimate | Free (on release) |
| 01 | Acquire without changing anything | The laptop is on your desk, powered off; IT also has a backup | A documented acquisition record with hashes, tool versions and a chain-of-custody log | Yes: Calder Logistics synthetic set. Image a provided virtual disk, verify E01 against source, mount with shadow copies visible | 2 to 4, planning estimate | Planned |
| 02 | Who is this user, on this machine | Legal asks whether the laptop was really hers and whether anyone else used it | A system and user profile: OS build, time zone, accounts, SIDs, last logons, installed software | Yes: Calder Logistics synthetic set. Profile the Matter A image from registry hives and user folders | 2 to 4, planning estimate | Planned |
| 03 | What did they run, and when | Her manager says she "ran something" the last night; the help desk saw a strange window | An execution timeline with confidence levels per artifact | Yes: Calder Logistics synthetic set. Prefetch, Amcache, Shimcache, UserAssist, BAM and SRUM evidence on the Matter A image | 2 to 4, planning estimate | Planned |
| 04 | What did they open, and where did it go | Finance wants to know which files she touched in her last two weeks | A file-interaction report: opened, created, moved, deleted, with the artifact that proves each | Yes: Calder Logistics synthetic set. LNK files, jump lists, shellbags, Office MRU and recent folders on the Matter A image | 2 to 4, planning estimate | Planned |
| 05 | The device in the parking lot | A USB drive turned up in her desk; security asks if it was ever plugged into the laptop | A device history connecting serial numbers, volume names, first and last connection, and the user session | Yes: Calder Logistics synthetic set. Registry device keys, setupapi logs, mounted-device evidence, matching the USB image's volume serial | 2 to 4, planning estimate | Planned |
| 06 | Sync, share, delete | IT found a personal cloud-sync client installed against policy | A cloud-storage findings sheet: what synced, when, what was deleted locally and what the sync database still records | Yes: Calder Logistics synthetic set. Cloud-sync client databases and logs on the Matter A image; browser traces of web uploads | 2 to 4, planning estimate | Planned |
| 07 | The browser tells it | Matter B: the complainant says the messages came from a work PC | A browser activity report for two users across two browsers, with session, download and cache evidence | Yes: Calder Logistics synthetic set. Chromium and Firefox profile parsing, SQLite recovery, private-mode limits on the Matter B image | 2 to 4, planning estimate | Planned |
| 08 | Mail as evidence | Matter B continues: HR produces a forwarded email; the respondent says it was altered | An email analysis memo: header path, client artifacts, server-side record, what can and cannot be proven | Yes: Calder Logistics synthetic set. OST and PST parsing, webmail cache traces, header reconstruction from the mailbox exports | 2 to 4, planning estimate | Planned |
| 09 | The contested logon | Matter D: "I was at lunch when that happened" | A logon reconstruction with event IDs, logon types, source addresses and the account's session map | Yes: Calder Logistics synthetic set. Security, System and RDP logs on the Matter D image; detecting a cleared log | 2 to 4, planning estimate | Planned |
| 10 | Deleted, recovered, proven | Matter C: a shared workstation; someone removed the unauthorized tool before the audit | A recovery report showing what existed, when it was removed, and which account did it | Yes: Calder Logistics synthetic set. MFT, USN journal and LogFile evidence for examiners; recovering deleted files; timestamp pitfalls | 2 to 4, planning estimate | Planned |
| 11 | Triage at speed | Twelve more Calder workstations need a look by Friday | A triage collection plan and an artifact-first timeline across several hosts | Yes: Calder Logistics synthetic set. Targeted collection, batch parsing with SIFT tools, building a combined timeline | 2 to 4, planning estimate | Planned |
| 12 | Write it so it survives cross-examination | Counsel wants the Matter A report, and the respondent in Matter B has a lawyer | The full Matter A examination report: findings, exhibits, timeline table, limitations, peer-review log | Yes: Calder Logistics synthetic set. Assemble the report from the earlier labs; a second learner reviews it against a checklist | 2 to 4, planning estimate | Planned |
Labs on SIFT.
The curriculum specifies the Calder Logistics synthetic set (three workstation images, one laptop image, one USB image, mailbox exports, cloud-sync logs), generated for DFIR.com and versioned. Evidence downloads will accompany released modules.
Install SIFTPlanned access: module 00 free; subscription $149 per month or $1,290 per year. No payment is being collected here.
Last reviewed . Curriculum source: Appendix A supplied by DFIR.com. Contribute a module.
Hear when the first modules open.
One email when there is something to learn from. No payment, nothing to buy.
Last reviewed