| File | Size |
|---|
| 1. Welcome and Introduction/1.Welcome and Introduction.ts | 350.12 MB |
| 10. Additional Content/01. Support - Onehack.Us.txt | 94.00 B |
| 10. Additional Content/31. Web Browser Forensics.ts | 267.64 MB |
| 10. Additional Content/32. Thumbs.db and Thumbcache.ts | 207.76 MB |
| 2. Initial Setup/2.Initial Setup.ts | 518.35 MB |
| 3. Windows Event Logs/00. Support - Onehack.Us.txt | 94.00 B |
| 3. Windows Event Logs/3. Fundamentals.ts | 247.67 MB |
| 3. Windows Event Logs/4. In-depth Analysis.ts | 523.98 MB |
| 3. Windows Event Logs/5. Tools and Best Practices.ts | 422.47 MB |
| 4. The Registry/10. Scalable Analysis.ts | 174.60 MB |
| 4. The Registry/6. Fundamentals.ts | 335.27 MB |
| 4. The Registry/7. NTUSER.DAT.ts | 360.03 MB |
| 4. The Registry/8. UsrClass.dat and ShellBags.ts | 296.78 MB |
| 4. The Registry/9. USB Forensics, Networks, and More.ts | 220.12 MB |
| 5. Evidence of Execution/11. Introduction.ts | 47.78 MB |
| 5. Evidence of Execution/12. Prefetch.ts | 545.34 MB |
| 5. Evidence of Execution/13. Shimcache.ts | 304.26 MB |
| 5. Evidence of Execution/14. AmCache.ts | 271.17 MB |
| 5. Evidence of Execution/15. PCA.ts | 31.78 MB |
| 5. Evidence of Execution/16. MUICache.ts | 87.38 MB |
| 5. Evidence of Execution/17. UserAssist.ts | 162.47 MB |
| 5. Evidence of Execution/18. SRUM.ts | 201.77 MB |
| 6. Persistence, Privilege Escalation, and Lateral Movement/19. Services and Scheduled Tasks.ts | 331.17 MB |
| 6. Persistence, Privilege Escalation, and Lateral Movement/20. LSASS, NTDS.dit, WDigest.ts | 168.74 MB |
| 6. Persistence, Privilege Escalation, and Lateral Movement/21. SMB, RDP, WMI, PsExec, UAL.ts | 259.15 MB |
| 7. Anatomy of NTFS/22. Introduction.ts | 43.90 MB |
| 7. Anatomy of NTFS/23. Metafiles, MFT, Journaling, ADS.ts | 295.73 MB |
| 7. Anatomy of NTFS/24. MACB Timestamps.ts | 165.52 MB |
| 7. Anatomy of NTFS/25. Parsing the MFT and USN Journal.ts | 204.59 MB |
| 7. Anatomy of NTFS/26. $I30 Index Attributes.ts | 38.24 MB |
| 8. File Deletion and Recovery/27. The Recycle Bin.ts | 31.42 MB |
| 8. File Deletion and Recovery/28. 'Permanent' Deletion.ts | 121.56 MB |
| 9. LNK Files and Jump Lists/29. LNK Files.ts | 201.28 MB |
| 9. LNK Files and Jump Lists/30. Jump Lists.ts | 132.53 MB |
| Extra/0. Support - Onehack.Us.txt | 94.00 B |
| Extra/ccnp security firewall notes.pdf | 5.91 MB |
| Extra/ccnp security secure notes.pdf | 751.57 kB |
| Extra/ccnp security sisas notes.pdf | 6.21 MB |
| Extra/cisco vpn chart.pdf | 51.71 kB |
| Extra/impacket exec commands cheat sheet poster.pdf | 1.62 MB |
| Extra/impacket exec commands cheat sheet.pdf | 563.33 kB |
| Extra/ntfs file record.pdf | 1.30 MB |
| Extra/rdp flowchart.pdf | 183.86 kB |
| Extra/splunk manual.pdf | 679.45 kB |
| Extra/windows browser artifacts cheat sheet.pdf | 259.71 kB |
| Extra/windows event log cheat sheet.pdf | 174.40 kB |
| Extra/windows process genealogy v2.pdf | 163.32 kB |
| Extra/windows registry cheat sheet.pdf | 254.06 kB |
| Support - Onehack.Us.txt | 94.00 B |
-