CyberCode Academy

CyberCode Academy

By CyberCode AcademyTechnologyEducationCourses
Download on the App Store

CyberCode Academy episodes

  • Course 36 - Windows Forensics and Tools | Episode 10: Decoding Metadata and File Internals
    In this lesson, you’ll learn about: Windows Recycle Bin forensics and deleted file recovery1. Why the Recycle Bin Matters in Forensics
    • Deleting a file in Windows does not immediately erase it
    • Instead, Windows:
      • Moves it to a hidden system structure
      • Renames it
      • Keeps both metadata and data intact
    🔹 Key Idea
    • The Recycle Bin is often a hidden evidence repository
    2. Core Forensic Insight
    • Deleted files usually remain:
      • On disk (physically intact)
      • With modified references only
    👉 Result:
    • Investigators can often recover:
      • Files
      • Paths
      • Deletion timestamps
    3. Legacy Windows Recycle Bin (Windows XP and earlier)🔹 Structure Used
    • INFO2 file
    • Stored inside:
      • Recycler folder
    🔹 What it contains
    • Original file path
    • File size
    • Deletion order
    👉 Key Insight:
    • Acts as an index of deleted files
    4. Modern Windows Recycle Bin (Vista → Windows 10)🔹 Structure Used
    • $Recycle.Bin
    🔹 File Pair SystemEach deleted file creates two entries:
    • $R file
      • Contains actual file data
    • $I file
      • Contains metadata:
        • Original name
        • Path
        • Deletion timestamp
    👉 Key Insight:
    • Data and metadata are split for tracking integrity
    5. Windows 10 Forensic Markers🔹 Version Identification
    • $I file headers contain version indicators:
      • 01 → older Windows versions
      • 02 → Windows 10 era
    🔹 Why it matters
    • Helps investigators determine:
      • Operating system version
      • Timeline of deletion activity
    6. Hex-Level Analysis🔹 Tools used
    • Hex editors
    • Forensic analysis tools
    🔹 What investigators extract
    • File paths
    • Deletion timestamps
    • File size metadata
    • Original filenames
    👉 Key Insight:
    • Even “deleted” files can be reconstructed byte-by-byte
    7. Forensic Workflow🔹 Step-by-step process
    1. Access $Recycle.Bin
    2. Match $R and $I files
    3. Decode metadata
    4. Reconstruct original file structure
    5. Extract evidence
    8. Investigative Value🔹 What can be recovered
    • Deleted documents
    • Malware payloads
    • Sensitive user files
    • Evidence of file wiping attempts
    👉 Key Insight:
    • Attackers often forget the Recycle Bin still holds traces
    Key Takeaways
    • Recycle Bin does not permanently delete data immediately
    • Legacy systems use INFO2 index files
    • Modern systems use $R and $I file pairs
    • Metadata and file content are separated
    • Hex analysis allows full reconstruction of deleted activity
    Big PictureRecycle Bin forensics helps investigators:👉 Move from “deleted file” → “recoverable digital evidence”Mental Model
    • Delete action → Recycle Bin redirect → hidden storage → forensic recovery


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    23 min
  • Course 36 - Windows Forensics and Tools | Episode 9: Uncovering Hidden Evidence
    In this lesson, you’ll learn about: Windows System Restore Points in digital forensics1. What Are System Restore Points?
    • A Windows feature that creates snapshots of system state
    • Designed for recovery after:
      • System failures
      • Bad updates
      • Software issues
    🔹 Key Idea
    • They act as a historical snapshot of system behavior
    2. Why They Matter in Forensics
    • Restore points preserve evidence that may be:
      • Deleted
      • Wiped
      • Modified
    🔹 Forensic Value
    • Helps reconstruct:
      • System changes
      • Malware introduction
      • Configuration modifications
    3. What Is Stored in Restore Points
    • Registry snapshots
    • Selected system files
    • Configuration data
    • Logs and application traces
    👉 Important Insight:
    • They preserve system state, not just individual files
    4. Metadata Preservation🔹 Key Concept
    • Restore points preserve MAC times:
      • Modified
      • Accessed
      • Created
    🔹 Why it matters
    • Enables accurate timeline reconstruction
    • Helps detect tampering or backdating attempts
    5. Trigger Events for Restore Points🔹 When Windows creates them
    • Software installation
    • System updates
    • Every ~24 hours of uptime
    • Manual user trigger
    👉 Key Insight:
    • Restore points are often created during high system activity periods
    6. Internal Structure of Restore Points🔹 Storage Location
    • Hidden directory:
    C:\System Volume Information 🔹 Folder Structure
    • Stored as sequential folders:
      • RP1
      • RP2
      • RP3
      • etc.
    7. File Tracking Mechanism🔹 Key Component
    • filelist.xml
    🔹 Purpose
    • Defines:
      • Which file types are monitored
      • Which directories are included
    👉 Key Insight:
    • Acts as a control map for snapshot creation
    8. Change Tracking System🔹 Important File
    • change.log
    🔹 Function
    • Records:
      • Original filenames
      • File locations
      • Snapshot changes
    👉 Forensic Value:
    • Helps reconstruct original file paths even after renaming
    9. System Management and Registry Control🔹 Registry Role
    • Controls:
      • Enable/disable restore points
      • Storage allocation
      • Behavior settings
    🔹 Storage Management
    • Uses FIFO (First-In, First-Out) rule
    • Older restore points are deleted first
    10. Forensic Applications🔹 What investigators can uncover
    • Malware presence in past states
    • Deleted files
    • System configuration changes
    • Evidence of cleanup attempts
    👉 Key Insight:
    • Restore points can reveal what was intentionally removed
    Key Takeaways
    • System Restore Points are system snapshots used for recovery
    • They preserve registry and file state over time
    • Stored in hidden System Volume Information directory
    • Include logs that track file changes and metadata
    • Can reveal deleted or tampered forensic evidence
    Big PictureRestore points help investigators:👉 Move from current system state → historical system reconstructionMental Model
    • System snapshot → stored RP folder → logs + registry + files → forensic timeline


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    26 min
  • Course 36 - Windows Forensics and Tools | Episode 8: Efficiency, Evidence, and Forensics
    In this lesson, you’ll learn about: Windows Prefetch and forensic execution tracking1. What is Windows Prefetch?
    • A Windows performance feature designed to:
      • Speed up application startup
      • Reduce disk access time
    🔹 Key Idea
    • It becomes a forensic artifact that records program execution
    2. How Prefetch Works
    • Windows monitors the first seconds of an application launch
    • It records:
      • Files accessed
      • Execution behavior patterns
    👉 Result:
    • A cached “startup map” is created for faster future runs
    3. Prefetch File Structure🔹 Naming Format
    • Application name + hash
    • The hash is an 8-character hexadecimal value
    🔹 Purpose of the Hash
    • Derived from the application path
    • Helps differentiate:
      • Same program in different locations
    👉 Key Insight:
    • Same executable in different folders = different Prefetch file
    4. Forensic Value of Prefetch🔹 What investigators can determine
    • When a program was executed
    • How many times it was run
    • Whether it ran from unusual locations
    5. The “Who, What, When” of Forensics🔹 Key Questions Answered
    • Who: Which program was executed
    • What: Which executable was run
    • When: Last execution timestamp
    👉 Important:
    • Prefetch is one of the strongest execution evidence sources in Windows
    6. Detecting Evidence Tampering🔹 Critical Insight
    • Presence of cleanup tools is itself evidence
    🔹 Example
    • If a wiping tool appears in Prefetch:
      • It proves the tool was executed
    👉 Key Idea:
    • “Trying to hide evidence” becomes evidence itself
    7. Hidden Activity Discovery🔹 Prefetch can reveal:
    • Hidden directories
    • External storage usage
    • Encrypted container activity
    🔹 Example targets
    • TrueCrypt volumes
    • External USB drives
    • Obfuscated folders
    8. System Evolution🔹 Related Windows Technologies
    • Superfetch
    • ReadyBoost
    👉 Purpose:
    • Improve system responsiveness and memory usage
    9. Registry Control of Prefetch🔹 Key Concept
    • Prefetch behavior can be enabled/disabled via registry settings
    🔹 Forensic Importance
    • Investigators check registry keys to see:
      • If Prefetch was disabled intentionally
      • If someone tried to hide activity
    10. Investigation Workflow🔹 How analysts use Prefetch
    1. Locate Prefetch files
    2. Extract execution metadata
    3. Analyze timestamps and counts
    4. Correlate with other artifacts
    Key Takeaways
    • Prefetch records application execution behavior for performance
    • It is a powerful forensic artifact for tracking user activity
    • File names include hashed execution paths
    • It can reveal hidden tools, drives, and user behavior
    • Disabling Prefetch may itself indicate suspicious activity
    Big PicturePrefetch helps investigators:👉 Move from “what exists on disk” → “what was actually executed”Mental Model
    • Program run → Prefetch created → Execution metadata stored → Timeline reconstructed


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    23 min
  • Registry Forensics and the User Assist Key
    In this lesson, you’ll learn about: Windows Registry artifacts and UserAssist forensics1. Why Registry Artifacts Matter
    • The Windows Registry stores hidden traces of user activity
    • Investigators use it to reconstruct:
      • User behavior
      • Application usage
      • System timelines
    🔹 Key Idea
    • Every click and execution leaves a forensic footprint
    2. Common Digital Footprints in Windows🔹 Types of artifacts
    • Internet browsing history
    • Email attachments
    • Skype / communication logs
    • Recently used files (MRU lists)
    • Executed programs
    👉 Key Insight:
    • Even deleted actions often remain in registry traces
    3. The UserAssist Key🔹 What is it?
    • A Windows Registry key that tracks program execution history
    🔹 What it records
    • Application name
    • Run count (how many times launched)
    • Last execution timestamp
    • Usage frequency
    👉 Why it matters:
    • Shows what a user actually ran, not just what exists on disk
    4. ROT13 Obfuscation🔹 What Windows does
    • UserAssist entries are encoded using a simple cipher:
    • ROT13 cipher
    🔹 Purpose
    • Obscures readable program names
    • Prevents casual inspection
    👉 Important Insight:
    • It is not encryption, just basic encoding
    5. Decoding UserAssist Data🔹 Tools used by investigators
    • UserAssistView
    • Magnet Forensics tools
    🔹 What they do
    • Decode ROT13 values
    • Convert registry entries into readable format
    • Display execution history clearly
    6. Building a Forensic Timeline🔹 What investigators reconstruct
    • When programs were opened
    • How often they were used
    • Sequence of user actions
    🔹 Why it matters
    • Helps establish:
      • Intent
      • Behavior patterns
      • Possible malicious activity
    7. Investigative Value of UserAssist🔹 What it reveals
    • User activity patterns
    • Application usage frequency
    • Time-based behavior analysis
    👉 Key Insight:
    • It helps answer: “What did the user actually do on the system?”
    8. Forensic Importance
    • Supports legal investigations
    • Helps detect insider threats
    • Builds evidence timelines
    Key Takeaways
    • Windows Registry contains deep user activity artifacts
    • UserAssist tracks executed programs and usage behavior
    • Data is encoded using ROT13, not securely encrypted
    • Specialized tools are needed to decode and analyze entries
    • It is essential for building accurate forensic timelines
    Big PictureUserAssist helps investigators:👉 Move from static system data → real user behavior reconstructionMental Model
    • Program run → Registry entry → Encoded record → Decoded timeline


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    21 min
  • Course 36 - Windows Forensics and Tools | Episode 6: From System Hives to Forensic Analysis
    In this lesson, you’ll learn about: Windows Registry structure and forensic analysis1. What is the Windows Registry?
    • A centralized configuration database in Windows
    • Stores system, user, and application settings
    🔹 Core Idea
    • Think of it as the brain of Windows configuration
    2. Registry StructureThe registry is organized in a strict hierarchy:🔹 Components
    • Hives
    • Keys
    • Subkeys
    • Values
    🔹 Analogy
    • Hive → main database file
    • Key → folder
    • Value → actual data entry
    3. Main Root Keys🔹 Key Windows Registry Roots
    • HKEY_LOCAL_MACHINE (HKLM)
    • HKEY_CURRENT_USER (HKCU)
    🔹 What they represent
    • HKLM → system-wide settings
    • HKCU → settings for the logged-in user
    4. Physical Storage of Registry Hives
    • Stored on disk in:
    C:\Windows\System32\config 🔹 Why this matters
    • Investigators can extract registry data directly from disk
    • Even if Windows is not bootable
    5. Core HKLM Sub-Hives🔹 SAM (Security Accounts Manager)
    • Stores:
      • User accounts
      • Password hashes
    🔹 SECURITY Hive
    • Stores:
      • Local security policy
      • LSA secrets
      • Authentication data
    🔹 SOFTWARE Hive
    • Stores:
      • Installed applications
      • Configuration settings
    🔹 SYSTEM Hive
    • Stores:
      • Drivers
      • Services
      • Boot configuration
    👉 Key Insight:
    • These hives are critical for system and user reconstruction
    6. Modern Windows Registry Extensions🔹 Newer Hives
    • BCD (Boot Configuration Data)
      • Controls boot process
    • ELAM (Early Launch Anti-Malware)
      • Protects early boot stage
    • Browser-related application data hives
    👉 Purpose:
    • Improve security and system initialization
    7. Forensic Extraction Tools🔹 Common Tools
    • FTK Imager
      • Used to extract registry hives from disk
    • Registry viewers (offline analysis tools)
    🔹 Why FTK Imager matters
    • Bypasses OS restrictions
    • Works on live or dead systems
    8. Registry Analysis Workflow🔹 Step-by-step process
    1. Acquire disk image
    2. Extract registry hives
    3. Load into analysis tool
    4. Examine keys and values
    9. What Investigators Look For🔹 Key Evidence Types
    • User activity
    • Installed software
    • System boot history
    • Malware persistence mechanisms
    Key Takeaways
    • The registry is a central configuration database for Windows
    • It is structured into hives, keys, and values
    • Critical hives include SAM, SECURITY, SOFTWARE, SYSTEM
    • Registry files are physically stored on disk
    • Tools like FTK Imager enable offline forensic extraction
    Big PictureRegistry analysis helps you:👉 Move from system configuration → user and attacker behavior reconstructionMental Model
    • Registry = Windows “black box” of system activity


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    21 min
  • Course 36 - Windows Forensics and Tools | Episode 5: Structure and Forensic Significance
    In this lesson, you’ll learn about: Windows Security Identifiers (SIDs) and user tracking1. What is a Security Identifier (SID)?
    • A SID (Security Identifier) is a unique value assigned to every:
      • User
      • Group
      • Security principal (system accounts, services)
    🔹 Core Idea
    • It acts like a permanent digital fingerprint in Windows
    • Used internally instead of usernames
    👉 Key Property:
    • A SID is never reused, even if the account is deleted
    2. Why SIDs Exist
    • Windows needs a stable way to identify identities
    • Usernames can change
    • SIDs cannot
    🔹 Example Use
    • Permissions are assigned to SIDs, not names
    • Access control checks rely on SID matching
    3. SID in Access Tokens🔹 What happens at login?
    • Windows creates an access token
    • This token contains:
      • User SID
      • Group SIDs
      • Privileges
    👉 Key Insight:
    • Every process inherits this token
    • This determines what the user can do
    4. Structure of a SIDA SID is not random—it has a strict format:🔹 Main Components
    • Identifier Authority
    • Sub-authority values
    • Relative Identifier (RID)
    5. SID Breakdown Explained🔹 Identifier Authority
    • Defines the system or domain origin
    • Example:
      • Local machine
      • Domain controller
    🔹 Sub-authorities
    • Represent hierarchical security structure
    • Provide organizational uniqueness
    🔹 Relative Identifier (RID)
    • The most specific part
    • Identifies the actual account
    6. Important RID Examples🔹 Common Built-in Accounts
    • 500 → Built-in Administrator
    • 501 → Guest account
    • 512 → Domain Admins group
    • 513 → Domain Users group
    🔹 Special Group
    • “Everyone” group → universal access SID
    👉 Key Insight:
    • RID tells you exactly what type of account it is
    7. How SIDs Are Used in Security🔹 Access Control
    • File permissions are assigned to SIDs
    • Not usernames
    🔹 Authentication Flow
    • Login → SID loaded → permissions applied
    8. Forensic Importance of SIDs🔹 What investigators can learn
    • Which user performed an action
    • Whether an account was deleted or renamed
    • Privilege escalation attempts
    🔹 Why it matters
    • Even if usernames change, SID stays the same
    • Enables long-term tracking of user behavior
    Key Takeaways
    • SIDs are permanent unique identifiers in Windows
    • They are used instead of usernames for security decisions
    • Stored inside access tokens during login
    • Structured into authority, sub-authority, and RID
    • Essential for forensic tracking and access control
    Big PictureSIDs help you:👉 Move from “who is the user?” → “what identity is truly behind the action?”Mental Model
    • Username → Human label
    • SID → System truth


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    22 min
  • Course 36 - Windows Forensics and Tools | Episode 4: From Acquisition to Volatility Analysis
    In this lesson, you’ll learn about: memory forensics and RAM analysis1. Why Memory Forensics Matters
    • RAM (volatile memory) is one of the most valuable forensic sources
    • It contains data that disappears after shutdown
    🔹 What RAM can reveal
    • Running processes
    • Active network connections
    • Command history
    • Encryption keys
    • Malware behavior in real time
    👉 Key Idea:
    • If disk is “history,” RAM is live truth
    2. Memory Acquisition (Capturing RAM)🔹 What is memory acquisition?
    • Creating a snapshot of physical RAM for analysis
    🔹 Common Tools
    • DumpIt
      • Simple one-click RAM dump tool
      • Used widely in field forensics
    • NotMyFault
      • Forces system crash
      • Generates full kernel memory dump
    👉 Key Tradeoff:
    • DumpIt → fast and simple
    • Crash dump → deeper but disruptive
    3. Types of Memory Evidence🔹 What investigators look for
    • Process objects
    • Suspicious threads
    • Injected code
    • Hidden malware artifacts
    🔹 Why it’s important
    • Malware often exists only in memory
    • Disk analysis alone may miss it
    4. Memory Forensic Techniques🔹 String Searching
    • Look for:
      • Passwords
      • URLs
      • Commands
      • API keys
    🔹 Process Inspection
    • Identify:
      • Legitimate processes
      • Suspicious or orphaned processes
    🔹 Thread Analysis
    • Detect:
      • Code injection
      • Hidden execution paths
    5. Deep Analysis with Volatility🔹 What is Volatility?
    • A powerful memory forensics framework for analyzing RAM dumps
    🔹 Key Capability
    • Extracts structured evidence from raw memory images
    6. Core Volatility Commands🔹 pslist
    • Shows active processes
    • Based on system process list
    🔹 psscan
    • Finds hidden or terminated processes
    • Scans memory directly
    🔹 psxview
    • Cross-checks multiple process sources
    • Detects rootkits and hidden malware
    👉 Key Insight:
    • If a process appears in psscan but not pslist, it may be hidden
    7. OS Profiling
    • First step in analysis is identifying:
      • Operating system version
      • Memory structure layout
    👉 Why it matters:
    • Correct profile = accurate results in Volatility
    8. Malware Detection in Memory🔹 What investigators look for
    • Injected DLLs
    • Suspicious network activity
    • Hidden execution threads
    🔹 Key Concept
    • Malware often hides better in RAM than on disk
    9. Reporting Findings🔹 Output process
    • Extract evidence
    • Convert results into structured reports
    • Document every forensic step
    👉 Goal:
    • Make results repeatable and legally defensible
    Key Takeaways
    • RAM is the most dynamic and valuable forensic source
    • Memory acquisition must be done carefully to preserve evidence
    • Tools like DumpIt and crash dumps capture volatile data
    • Volatility enables deep inspection of memory structures
    • Cross-checking process lists helps detect hidden malware
    Big PictureMemory forensics helps you:👉 Move from live system behavior → hidden system truthMental Model
    • Capture RAM → Identify OS → Analyze processes → Detect anomalies → Report findings


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    23 min
  • Course 36 - Windows Forensics and Tools | Episode 3: Mastering dd.exe for Drives and Memory
    In this lesson, you’ll learn about: forensic imaging using the DD utility1. What is DD (Data Dumper)?
    • A low-level command-line tool used for bit-by-bit copying
    • Commonly used in digital forensics imaging
    🔹 Core Function
    • Copies data from:
      • Input → Output
    • Without interpreting or modifying it
    👉 Key Idea:
    • It creates an exact raw duplicate of data
    2. Basic DD Syntax🔹 Core Parameters
    • if= → input source
    • of= → output destination
    • bs= → block size
    • count= → number of blocks
    🔹 Example Concept
    • Input disk → output image file
    👉 Important Insight:
    • DD does not “understand” files
    • It works at raw byte level
    3. Block Size Optimization🔹 Why it matters
    • Controls how much data is copied per operation
    🔹 Performance Tradeoff
    • Larger block size:
      • Faster imaging
    • Too large:
      • Can exhaust system memory
    👉 Best Practice:
    • Balance speed vs system stability
    4. Imaging Storage Devices🔹 Workflow Steps
    1. Identify storage device
    2. Find volume/drive identifier
    3. Run DD imaging command
    4. Save output as forensic image
    🔹 Supported Media
    • USB drives
    • Hard disks
    • Optical media (CD/DVD ISO extraction)
    👉 Key Technique:
    • Use size limits to avoid reading past device boundaries
    5. RAM (Memory) Acquisition🔹 What is it?
    • Capturing live system memory (volatile data)
    🔹 Why it matters
    • Contains:
      • Running processes
      • Active network connections
      • Encryption keys
    🔹 DD Advantage
    • No kernel driver required in some cases
    • Direct raw memory capture
    🔹 Limitation
    • Data may be inconsistent ("blurred")
      • Because system is actively changing
    6. Windows Security Restrictions🔹 Modern Windows Behavior
    • Blocks direct access to physical memory
    🔹 Affected Systems
    • Windows XP 64-bit
    • Windows Server 2003+
    🔹 Requirements
    • Administrator privileges required
    • Often requires alternative forensic tools
    7. Forensic Integrity Principles🔹 Key Goals
    • Bit-for-bit accuracy
    • No modification of original evidence
    🔹 Why DD is important
    • Ensures raw acquisition of evidence
    • Preserves original disk structure
    Key Takeaways
    • DD is a powerful low-level forensic imaging tool
    • It works by copying raw bytes from source to destination
    • Block size directly affects performance and stability
    • It can be used for disks, USBs, CDs, and even RAM
    • Modern Windows systems restrict physical memory access
    Big PictureDD helps you:👉 Move from live system → raw forensic imageMental Model
    • Select device → set parameters → raw copy → verify integrity


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    24 min
  • Course 36 - Windows Forensics and Tools | Episode 2: Windows Forensic Imaging and Drive Nomenclature
    In this lesson, you’ll learn about: Windows forensic imaging and data structure fundamentals1. What is Forensic Imaging?
    • A bit-by-bit, sector-by-sector copy of a storage device
    • Captures everything, not just visible files
    🔹 What it Includes
    • Active files and folders
    • Deleted files
    • Unallocated space
    • Slack space
    👉 Key Difference:
    • Not a backup → it is an exact forensic replica
    2. Why Forensic Imaging Matters
    • Preserves original evidence
    • Prevents modification of:
      • File timestamps
      • Metadata
    👉 Legal Importance:
    • Required for court-admissible investigations
    3. Physical vs Logical Drives (Windows Naming)🔹 Physical Drives
    • Identified as:
      • Disk 0
      • Disk 1
    • Represent actual hardware
    🔹 Logical Drives
    • Represent partitions using letters:
      • C:
      • D:
      • E:
    👉 Analogy:
    • Physical disk → entire cabinet
    • Logical drives → drawers inside the cabinet
    🔹 Historical Note
    • A: and B: reserved for floppy disks
    4. File System Hierarchy🔹 Structure Levels
    1. Volume (highest level)
    2. Partition
    3. Directory (folder)
    4. File
    🔹 File Definition
    • A logical grouping of related data
    👉 Key Insight:
    • Understanding hierarchy helps in locating and analyzing evidence
    5. Processes and Threads (Execution Basics)
    • Process → running program
    • Thread → smallest execution unit within a process
    👉 Why it matters:
    • Helps track:
      • Program execution
      • Malicious activity
    6. Data Integrity & Verification🔹 Hashing Concept
    • Generate a unique fingerprint for data
    🔹 Algorithm Example
    • MD5 hash
    🔹 Key Properties
    • Same file → same hash
    • Rename file → hash unchanged
    • Change 1 bit → completely different hash
    👉 Use Case:
    • Verify forensic image integrity
    7. Chain of Trust in Forensics
    • Acquire image → generate hash
    • Analyze copy → compare hash again
    👉 Goal:
    • Ensure no tampering occurred
    Key Takeaways
    • Forensic imaging captures complete disk data, including hidden content
    • Physical and logical drives represent different abstraction layers
    • File systems follow a structured hierarchy
    • Hashing ensures data integrity and authenticity
    • Even a tiny change in data invalidates evidence
    Big PictureForensic imaging helps you:👉 Move from raw disk → verified evidence copyMental Model
    • Disk → Image → Hash → Analyze → Verify


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    22 min
  • Course 36 - Windows Forensics and Tools | Episode 1: Debunking Myths and Mastering Methodology
    In this lesson, you’ll learn about: digital forensics in Windows environments1. What is Digital Forensics?
    • Also known as computer forensics
    • The application of scientific methods to digital investigations
    🔹 Core Objectives
    • Identify digital evidence
    • Preserve its integrity
    • Analyze findings
    • Present results for legal use
    👉 Key Idea:
    • Evidence must be accurate, repeatable, and legally admissible
    2. Why Focus on Windows?
    • Majority of systems run Windows
    • Widely used in:
      • Personal computing
      • Enterprise environments
    🔹 Challenges
    • Undocumented internal features
    • Limited low-level access
    • Complex system structure
    👉 Result:
    • Windows forensics requires specialized knowledge and tools
    3. Investigation Methodology (SANS Framework)
    • Developed by the SANS Institute
    🔹 The 8-Step ProcessStep 1: Initial Assessment
    • Confirm incident
    • Define scope
    • Identify affected systems
    👉 Goal:
    • Understand what happened and where
    Step 2: System Description
    • Document:
      • Hardware specs
      • OS configuration
      • Network role
    👉 Importance:
    • Provides context for analysis
    Step 3: Evidence Acquisition🔹 Types of Data
    • Volatile Data:
      • RAM
      • Running processes
      • Network connections
    • Non-Volatile Data:
      • Hard drives
      • Logs
      • Files
    🔹 Critical Concepts
    • Chain of custody
    • Data integrity verification (hashing)
    👉 Rule:
    • Never alter original evidence
    Step 4: Timeline Analysis
    • Reconstruct system activity over time
    👉 Helps answer:
    • When did the attack happen?
    • What actions were performed?
    Step 5: Media Analysis
    • Examine:
      • File systems
      • Program execution
      • Deleted files
    👉 Insight:
    • Reveals user and attacker behavior
    Step 6: String & Byte Search
    • Search for:
      • Keywords
      • Signatures
      • Binary patterns
    👉 Use Case:
    • Detect malware traces or hidden data
    Step 7: Data Recovery
    • Recover data from:
      • Unallocated space
      • Slack space
    👉 Importance:
    • Deleted ≠ gone
    Step 8: Reporting
    • Create formal report
    🔹 Must Include
    • Verified findings
    • Methods used
    • Evidence references
    👉 Requirement:
    • Must be clear, objective, and defensible in court
    4. Windows Artifacts (Key Evidence Sources)🔹 Common Artifacts
    • Registry
    • Prefetch files
    • Restore points
    • Recycle Bin
    👉 What they reveal:
    • Program execution history
    • User activity
    • System changes
    5. Cybersecurity Use Case🔹 When Digital Forensics is Used
    • Incident response
    • Malware analysis
    • Legal investigations
    👉 Outcome:
    • Understand:
      • Attack methods
      • Impact
      • Responsible actions
    Key Takeaways
    • Digital forensics applies scientific investigation to digital systems
    • Windows analysis is complex but essential
    • SANS methodology ensures structured and reliable investigations
    • Evidence handling must preserve integrity
    • Artifacts reveal hidden user and attacker activity
    Big PictureDigital forensics helps you:👉 Move from incident → evidence → truthMental Model
    • Collect → Preserve → Analyze → Report


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    23 min

About CyberCode Academy

From the publisher's feed

Welcome to CyberCode Academy — your audio classroom for Programming and Cybersecurity.
🎧 Each course is divided into a series of short, focused episodes that take you from beginner to…