New Horizons
Project Management Academy
Six Sigma Online
TCM Security
TRACOM
Velopi
Watermark Learning
Login
We are excited to announce that Windows Evidence Acquisition and Triage is the newest addition to the TCM Security Academy. The course was created by Andrew Prince and is the second course in our Windows Forensics learning path, building directly on Introduction to Windows Forensics.
When an incident hits, the first decisions an examiner makes are the ones that decide what evidence will ever be recoverable. Power down the wrong machine and the evidence on it is gone. Collect the wrong way and the artifacts you needed were never captured. This course teaches you how to make those calls with confidence, and how to collect fast without giving up defensibility.
Why We Built This Course
Introduction to Windows Forensics gave students the investigative mindset and the fundamentals of acquisition. This course picks up where those fundamentals leave off and turns them into decisions you make under real conditions, where volatility, encryption, system state, and time pressure all pull in different directions.
Acquisition is the step that decides whether the rest of an investigation is even possible. Get it wrong and no amount of skilled analysis later can recover what was never collected. We built this course to give aspiring DFIR analysts a clear, practical method for acquiring evidence correctly the first time, because it is a step you rarely get to repeat.
What You Will Learn
The course is built around the two skills you will use most in the field: building a defensible acquisition plan, and running rapid triage collection.- Choose the right acquisition method for the scenario, across live and dead acquisition, full disk imaging, targeted triage, and memory capture
- Sequence collection by order of volatility while weighing encryption, system state, and time pressure
- Detect encryption before it costs you the evidence
- Ground every decision in recognized standards so your work holds up to scrutiny
- Enumerate the Windows triage artifact set and prioritize it when the clock is running
- Run defensible, targeted triage collections with KAPE using Targets and Modules
- Write and validate your own custom KAPE Target
- Document a live collection so it stays defensible even though the act of collecting changes the system
Who Should Take This Course
This course is designed for three audiences in particular:Aspiring digital forensic examiners and incident responders: If you want to build a career in DFIR, this course gives you the foundational knowledge to get started on the right foot.
IT and security professionals expanding into DFIR: If you already work in security and want to add forensics to your skillset, this course bridges the gap between general security knowledge and hands-on investigative work.
Cybersecurity students building toward a forensics specialization: This course is the starting point for TCM Academy’s Windows Forensics learning path. Everything that follows builds on what you learn here.
Ready to Get Started?
Windows Evidence Acquisition and Triage is available now on the TCM Security Academy. Start building the skills that decide whether the evidence is there when you need it.
About the Author: Megan Percy
Megan Percy is the Senior Product Manager at TCM Security, where she focuses on building impactful cybersecurity training. With a background spanning digital forensics and network security, she’s passionate about making complex ideas accessible through great storytelling. When she’s not shaping the future of the TCMS platform, you’ll find her reading, cooking, or playing Magic: The Gathering (Commander).
About TCM Security
TCM Security is a veteran-owned, cybersecurity services and education company founded in Charlotte, NC. Our services division has the mission of protecting people, sensitive data, and systems. With decades of combined experience, thousands of hours of practice, and core values from our time in service, we use our skill set to secure your environment. The TCM Security Academy is an educational platform dedicated to providing affordable, top-notch cybersecurity training to our individual students and corporate clients including both self-paced and instructor-led online courses as well as custom training solutions. We also provide several vendor-agnostic, practical hands-on certification exams to ensure proven job-ready skills to prospective employers.
Pentest Services: https://tcm-sec.com/our-services/
Follow Us: Email List | LinkedIn | YouTube | Twitter | Facebook | Instagram | TikTok
Contact Us: sales@tcm-sec.com
See How We Can Secure Your Assets
Let’s talk about how TCM Security can solve your cybersecurity needs. Give us a call, send us an e-mail, or fill out the contact form below to get started.
