Skip to content
TrackPodcasts
educationJan 31, 202614:55pending

Course 21 - Digital Forensics: Windows Shellbags | Episode 2: Forensic System Setup and Local Drive Integration

CyberCode Academy

About this episode

In this lesson, you’ll learn about:
  • Preparing a Forensic Workstation
    • The purpose of using a controlled forensic setup to safely extract and analyze system artifacts.
    • Why working from an acquired drive or image is critical for maintaining evidentiary integrity.
  • Essential Tools for Shellbag and Registry Analysis
    • Shellbags Explorer: Used to parse and analyze shellbag artifacts associated with user folder navigation.
    • FTK Imager (Lite): A portable, self-contained tool for accessing drives and exporting forensic artifacts without installing software on the target system.
  • Loading a System Drive as Evidence
    • How to use “Add Evidence Item” in FTK Imager to load a local physical drive (e.g., the C: drive).
    • Understanding the evidence tree and how FTK represents the file system for forensic browsing.
  • Navigating the File System for Forensic Artifacts
    • Traversing the directory structure within FTK Imager to locate user-specific data.
    • Focusing on the Users directory and individual user home folders, which contain critical registry files.
  • Target Registry Files for Analysis
    • Identifying user-specific registry hives stored within the home directory.
    • Understanding why these files are essential inputs for tools like Shellbags Explorer when reconstructing user activity.
By the end of the episode, you’ll be able to set up the required forensic tools, load a system drive as evidence, and confidently locate the registry hives needed to analyze shellbags and other user activity artifacts.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy

Get every episode summarized

Each time CyberCode Academy publishes, we email you a written briefing from the transcript — the topics, who appeared, and any specific claims, with the ad reads skipped.

Email me new episodes

Free for 3 shows. No card needed.

No transcript yet

This episode has not been transcribed. Request it and it moves to the front of the queue.

Course 21 - Digital Forensics: Windows Shellbags | Episode 2: Forensic System Setup and Local Drive Integration

CyberCode Academy

0:00
14:55

More episodes

More from CyberCode Academy

View all episodes →

Course 42 - Mobile Malware Analysis Fundamentals | Episode 9: Mastering Basic St...

CyberCode Academy

Sep 5, 202621:16completed

Course 42 - Mobile Malware Analysis Fundamentals | Episode 8: Static Analysis of...

CyberCode Academy

Sep 4, 202621:15completed

Course 42 - Mobile Malware Analysis Fundamentals | Episode 7: Malware Tools and...

CyberCode Academy

Sep 3, 202621:03completed

Course 42 - Mobile Malware Analysis Fundamentals | Episode 6: The Evolution and...

CyberCode Academy

Sep 2, 202622:42pending