What Windows admins need to know about computer forensics

The video discusses the challenges of understanding digital forensics, emphasizing the complexity of analyzing data without the usual operating system view. It highlights tools like FTK Imager and Wireshark, stressing the importance of establishing a baseline of normal activity for effective forensic analysis. The video also covers the use of Microsoft Defender for endpoint monitoring and the necessity of planning and expertise in forensic investigations.

What new insight or understanding did you gain from this video?