Hey everyone, my name is Liam Cleary,
and welcome to my course PowerShell Live Response Forensics.
I'm the CEO and owner at SharePlicity,
as well as a Microsoft MVP and a Microsoft Certified Trainer.
As a member of the IT or security team much of your time is spent
reviewing various operating systems and applications.
The goal of this is to often identify anomalies or security risks.
There are many tools available to help with this triage process; however,
an underutilized tool is PowerShell.
PowerShell provides all the capabilities required
to retrieve system information,
as well as working well with other tools such as the Sysinternals utilities.
Using third‑party add ons to PowerShell you can even perform disk analysis.
In this course,
we're going to walk through using PowerShell to perform
initial triage and basic disk forensics.
Some of the major topics that we will cover include,
using execution policies within PowerShell,
collecting system information using PowerShell,
using the Sysinternals utilities directly with PowerShell,
creating a triage script, exporting the triage data into HTML and log files,
and then how to use PowerForensics for basic disk analysis.
By the end of this course you'll understand how to use PowerShell to
perform initial triage and disk analysis on computers.
You do not need previous PowerShell experience for this course,
though it is helpful.
You do however need an understanding of Windows servers and clients.
From here,
you should feel comfortable diving into overall PowerShell
scripting and management with courses on Getting Started
with PowerShell Scripting, Working Smarter with PowerShell Background Jobs,
Windows PowerShell Scripting and Tool Making,
Automation with Windows PowerShell,
Getting Started with PowerShell Core on Linux and macOS,
Managing Computers with PowerShell and CIM,
PowerShell Functions for Security Analysis,
and then Continuous Monitoring with PowerShell.
I hope you'll join me on this journey to learn how PowerShell can
assist with triage and disk analysis with the PowerShell Live
Response Forensics course at Pluralsight.