Windows Forensic Analysis Toolkit

I am not an expert. I have never claimed to be an expert at anything (at least not seriously done so), least of all an expert in digital forensic analysis of Windows systems. I am simply someone who has found an interest in my chosen field of employment, and a passion to dig deeper. I enjoy delving into and extending the investigative process, as well as exploring new ways to approach problems in the field of digital forensic analysis. It was more than 13 years ago that I decided to focus on Windows systems specifically, in large part because no one else on the team I worked with at the time did so. We had folks who focused on routers and firewalls, as well as those who focused on Linux; however, almost no effort, beyond enabling configuration settings in the vulnerability scanner we used, was put toward really understanding Windows systems. As I moved from vulnerability assessments into incident response and digital forensic analysis, understanding what was happening “under the hood” on Windows systems, understanding what actions could create or modify certain artifacts, became a paramount interest.