Training
Featured CourseView All Courses
Get a free hour of SANS training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
Cloud Security Training
Can't find what you are looking for?

Let us help.

Contact us
Resources
SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

CISO Network

Engage, challenge, and network with fellow CISOs in this exclusive community of security leaders

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations
Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Talk with an expert
Talk with an expert

Updated Windows Forensic Analysis Poster

The new version of the FOR500: Windows Forensics Poster was a nearly complete re-write of the poster with significant updates made to every section.

Authored byChad Tilbury
Chad Tilbury

I am thrilled to announce the latest release of the SANS DFIR Windows Forensic Analysis poster. This version was a nearly complete re-write of the poster with significant updates made to every section. The “Evidence of...” categories were originally created by SANS Digital Forensics and Incident Response faculty for the SANS FOR500: Windows Forensics course, mapping specific Windows forensic artifacts to the analysis questions they can help to answer. The poster is designed to be used as a cheat sheet to remember and discover important Windows operating system artifacts relevant to investigations into computer intrusions, insider threats, fraud, employee misuse, and many other common cybercrimes. Changes in this version include:

  • Support for artifacts found on Windows XP through Windows 11
  • Updates to the Browser Activity section including the latest artifacts from Chrome, Firefox, and Edge (Chromium)
  • New Cloud Storage artifacts for OneDrive, Google Drive, Box, and Dropbox
  • External Device and USB Usage updates to support HID, USBSTOR, and USB Attached SCSI device profiling
  • Updated Application Execution artifacts including Task Bar Feature Usage and CapabilityAccessManager registry keys

Picture1.png

Putting these posters together takes an immense amount of time and I would like to give special thanks to Kathryn Hedley (@4enzikat0r) for her assistance on this version. We sincerely hope that free resources like this will benefit forensic examiners around the world. Download the PDF version here and look for the shiny new printed versions at select in-person SANS conferences!

Meet the expert

Chad Tilbury
Chad Tilbury

Chad Tilbury

Fellow

As a Special Agent with the Air Force Office of Special Investigations, Chad served on the national computer intrusion team and helped expand counter-espionage techniques. At SANS, Chad is a senior instructor and co-author for FOR500 and FOR508.

Read more about Chad Tilbury