The case & evidence handling
Frame the investigation, preserve integrity, and record acquisition decisions.
Masterclass 02 · free · on demand
Digital Forensics
Operations
Investigating Windows Evidence with Ubuntu
Watch a forensic investigation unfold as we examine Windows memory, disk artifacts, and event logs from Ubuntu. Follow the instructor-led recording and learn how evidence supports each conclusion.
Recorded October 10, 2026 · Watch free on demand
Format
On-demand recording
Pause, replay and learn at your pace
Topic
Windows evidence
Instructor-led investigation from Ubuntu
Access
Free to watch
No registration required · English
Free masterclass · on demand
Watch. Learn. Revisit.
Digital Forensics Operations
Investigating Windows Evidence with UbuntuNo registration required. Playing the video connects to YouTube.
Less guesswork. Better questions.
Turn scattered traces
into a supported story.
Follow a case-based walkthrough of the analyst’s process. Learn what the evidence supports, what it does not, and where to investigate next.
01 / PRESERVE
Protect the evidence.
Understand acquisition choices, hashes, working copies, and the notes that make an investigation repeatable.
02 / EXAMINE
Find the useful traces.
Examine processes, network connections, filesystem activity, Prefetch, event logs, and Registry artifacts.
03 / CONNECT
Build the timeline.
Correlate sources, normalize timestamps, and distinguish an observation from an assumption.
04 / EXPLAIN
Make findings useful.
Summarize the sequence of events, record confidence and gaps, and identify the next evidence to collect.
Session topics
One case.
Follow every lead.
Explore the investigation topics covered by the masterclass. Use the YouTube player to pause and revisit sections.
Memory tells the first story
Inspect process relationships and network artifacts to develop leads.
Follow the trail on disk
Connect filesystem timestamps, browser traces, Prefetch, and Windows event logs.
Registry clues & the timeline
Examine persistence and user activity artifacts. Correlate the findings across sources.
Findings and next steps
Explain the findings, document uncertainty, and identify the next evidence to collect.
Is this for you?
Curiosity required.
Expert status optional.
This session is designed for SOC analysts, IT professionals, incident responders, and learners building a foundation in digital forensics.
- 01 Basic familiarity with Windows and command-line concepts will help.
- 02 The instructor performs the lab on Ubuntu while you follow the recorded investigation. No installation is required.
- 03 We focus on investigation and interpretation. This is not a full certification course.
Curriculum reference: ENISA, Forensic analysis: Local Incident Response, teacher handbook (2016). This independent rimpianto session adapts selected investigation topics; it is not affiliated with or endorsed by ENISA.
About the recording
A few practical details.
Is the recording free?
Yes. Watch the masterclass here or on YouTube without registering.
Do I need to install any tools?
No installation is required to watch. The instructor demonstrates the investigation using Ubuntu.
Can I pause and revisit sections?
Yes. Use the YouTube player controls to pause, seek and replay the recording.
Where can I find more masterclasses?
Explore our Events page and follow the Iron Fist Labs channel on YouTube for more cybersecurity training.
Keep exploring