Learn evidence preservation, disk imaging, memory analysis, Windows artifacts, event logs, timelines, and chain of custody.
Select a lesson.
Open these beside the lesson when practical.
Continue through the curriculum.