Hello Reader,
            Are you in the Middle East? If so I’m to Jeddah Saudi Arabia for the first time to teach SANS FOR500 Windows Forensics:
https://www.sans.org/event/jeddah-march-2019/course/windows-forensic-analysis

If you like any of the things I write about or show here on the blog you will love this 6 day class as we go deep into Windows Forensics from Windows Vista through Windows 10 along with some talk about Windows Server.

When I teach FOR500 I fill the day with practical demonstrations of how and why things work so you can understand the scope of any artifact, its limitations and how you can rely on it.

Since my last time in the Middle East I’ve learned even more about Windows artifacts and I hope you will come out to spend a week with me and go in-depth into Windows Forensics and learn how to solve the toughest cases. We will go beyond the book and into the state of the art of whats possible today.