Course Descriptions

Presents the most important aspects of the internal design and implementation of the Windows operating system in a three-day lecture+demo/hands-on format. 

This seminar combines our Core Windows Internals seminar with in-depth coverage of the Windows Performance Toolkit, all presented with extensive hands-on labs.

Our "flagship" Windows Internals seminar, covering more topics in more detail and with more hands-on time.

Learn how current Windows operating systems are designed and implemented, and immediately apply that knowledge to isolate the causes of system and application failures and performance problems. 

(placeholder)

This seminar teaches you how to use the Windows debugging tools, Performance utility, Performance Toolkit, event logs, and other tools. These will be used to diagnose performance problems and resource issues, to isolate the causes of operating system failures and system hangs, and to debug application failures. 

This seminar provides a fast but comprehensive introduction to the use of the Windows Debugging Tools, Windows Performance Toolkit, and other tools for "live" kernel mode debugging, memory dump analysis. and performance analysis. 

This seminar provides a fast introduction to kernel mode debugging and memory dump analysis on Itanium platforms.

An extensive, in-depth tutorial on the use of the Microsoft Windows Debugging Tools on Itanium platforms.

 NEW!  Go beyond the basics of debugging with this intensive seminar. 

For programmers new to Windows and Win32 programming, this seminar provides an introduction to the idioms of Windows and an orientation to APIs and mechanisms commonly used in "systems level" programs.

Get started with IoT on Windows with the Raspberry Pi in this fast-paced seminar! 

This seminar covers the Office Open XML (OOXML) file formats used by current versions of Microsoft Office. 

A one-day introduction to the various Windows device driver environments. Covers all current Windows operating systems and all driver models.

A guided tour of the internal design and implementation of the current Windows operating systems, with particular emphasis on those aspects that are important to driver developers.

Teaches you how to develop, install, and debug the most common types of WDM device drivers for Windows operating systems.

This seminar teaches you how to write, package, install, and debug drivers using the Windows Driver Foundation models: Kernel Mode Driver Frameworks (KMDF) and User Mode Driver Frameworks (UMDF 2.0). These are the driver models recommended by Microsoft for all devices for which a more specialized driver model is not available. 

This seminar describes how to write, package, install, and debug drivers using User Mode Driver Frameworks 1.x.

An intensive hands-on tutorial on debugging device drivers, via both “live” debugging and analysis of memory dumps. The latter includes techniques for looking at code for which you don't have the source. 

An intensive seminar that teaches you how to develop, install, and debug WDM device drivers for devices on backplane buses (commonly PCI, PCI-Express, and PCcard). Bus drivers, bus filter drivers, and various advanced system interfaces are included.

This seminar focuses on developing and installing network interface card (NIC) Miniport and Intermediate drivers for NDIS 5. 

This seminar focuses on developing and installing network interface card (NIC) Miniport, Lightweight Filter (LWF), and Intermediate drivers. 

This seminar covers function drivers for devices on the IEEE 1394 bus.

This seminar covers the specifics of functional drivers for devices on the USB bus.

This seminar covers Windows StorPort miniport drivers: drivers for storage controller class devices, i.e. disk controllers. These include drivers for SCSI controllers (SCSI host bus adapters), for FibreChannel controllers, for IDE and SATA RAID adapters, and for other controllers for storage class devices. 

Attendees will learn how to port Windows drivers to all supported 64-bit platforms. You will also learn debugging techniques specific to the 64-bit extended (X64) systems.

Developers who need to write or maintain Windows File System Drivers.

In this seminar you will learn how to design and write a Windows file system minifilter driver. 

This seminar covers the “next-generation” cryptography (CNG) support in Windows Vista through Windows 8 and Windows Server 2012. 

Security is one of the most important responsibilities of a multi-user operating system. Windows provides an enormous number of security features, many of them added quite recently, many of them still unknown to users and system administrators. This seminar presents the security features of Windows in "internals" terms, covering not only administrator-level controls and visibility, but also describing their internal implementation, their visibility, and tradeoffs of their use.

This seminar teaches how to "lock down" a Windows server and its clients to ensure reliable and secure operation, consistent with the enterprise’s unique security policies. 

This seminar covers how data is physically stored in a computer system, and provides detailed information on RAM, ROM, Flash, CD, DVD, Hybrid Hard Disks, and Blu-Ray.  Learn about the recovery potential from a variety of storage devices.

Most recent malware is used for financial or political gain, and although often referred to as "viruses," the attack and propagation methods are very different from true viruses. This course is an overview of the types of malware, how malware is categorized, and how each type of malware attacks a Windows system. This allows the forensic investigator to identify malware used in criminal attacks.

How does malware work? How do you trace where malware came from? In order to defeat your enemy, you must understand your enemy. This course covers the various types of malware and how it typically operates in a Windows system. 

All modern malware works within the operating system, not only by exploiting weaknesses but also by using features that are there for everyday use. It is therefore impossible to understand how malware works without a deep understanding of the operating system it targets. This seminar provides detailed information on how Windows works internally, with special focus on common malware attack methods. It includes coverage of Windows’ most recent security features, most of them specifically added to combat malware.  

Encryption is being used more and more in legitimate business, as well as within criminal enterprises. Learn about the types of encryption available in Windows, the weaknesses, and what it takes to either decrypt files that have been encrypted or to defeat the encryption by other means. Includes the detection of hidden volumes as implemented by, for example, TrueCrypt. 

BitLocker is being used more and more to protect the contents of disks from loss and theft. Unfortunately, it is also being used by cybercriminals to hide their activities from law enforcement. This course describes the internal operation of BitLocker, and how  law enforcement can defeat it in some cases. 

Virtual machines are useful for many purposes in computing, but they can also be used to hide evidence of user activity on a computer system. Cybercriminals are using virtual machines because it is apparently easy to remove all trace of their activities just by deleting a single file. This seminar describes virtual machines, their methods of operation, how they are used to hide user activity, and how to detect their use. It also describes how to use virtual machines for malware analysis and other aspects of cyber forensics. 

Understanding how files are stored (and may be hidden) on a disk or other storage media (solid-state disk, USB "key", SD card, etc.), is essential to performing a thorough forensic investigation. Learn the essentials of the on-disk formats of NTFS, EFS, FAT 12/16/32, exFAT, CDFS, and UDFS. This seminar also covers details of partitioning methods (MBR vs. GPT), the various types of Windows "volumes," basic vs. dynamic disks, and the new Storage Spaces. 

Windows miaintains a significant amount of data on its past activity as part of its normal operation. This is used for self-diagnosis, performance monitoring, and error reporting, as well as for common functions such as user login/logiout tracking and file access auditing. Using this information, a forensic investigator can create a detailed timeline of a user’s activities, going back months or in some cases years. Learn what information Windows maintains and where to find it. 

How is data transmitted from one machine to another over the Internet? What network protocols are used by the Internet? How do you capture network traffic? What information is recorded by a user’s Internet Service Provider? How do you trace the origin of a Distributed Denial of Service Attack? This course will answer these questions and more, and provide the forensic investigator with the knowledge necessary to gather information about a suspect’s use of the internet. The student will learn how to capture network traces and trace the route through the Internet that packets followed. 

This seminar presents the complete details of the NTFS file system on-disk structure. You will learn how files are stored in NTFS, how directory indexes work, and how to recover deleted files and partitions.

This seminar presents the complete details of the FAT file systems. Learn how files are stored, and how to recover some deleted files.

This seminar provides an introduction and orientation to Code Center Premium and to the Windows operating system source trees.

This seminar provides a comprehensive guided tour through, and analysis of, the internal design, implementation, and operation of the major components of the Windows operating system, with a corresponding tour of the Windows source code.