← incident responder
Take Quiz →
Windows Forensic Acquisition — Triage, Imaging, and Chain of Custody
intermediate 4h
Acquire volatile memory, targeted triage artifacts, and full disk images from Windows systems while preserving forensic integrity and maintaining defensible chain of custody.
Lessons
1 Order of Volatility — What to Collect First and Why
20 min 2 Memory Acquisition — Tools, Techniques, and Triage Artifacts
25 min 3 Disk Imaging and Triage Collection — Full Images vs. Targeted Artifacts
25 min 4 Chain of Custody — Documentation, Evidence Handling, and Defensibility
20 min 5 Enterprise Acquisition at Scale — Velociraptor and Remote Forensics
25 min Module Quiz
Test your knowledge before moving on.