Escalate your investigative depth with Forensic Phase 02. OCFI-B shifts the focus from data acquisition to deep-dive artifact analysis. You will deconstruct the Windows Operating System to uncover hidden user activity, analyzing critical evidence sources such as the Registry, Prefetch, Shimcache, and Event Logs. The curriculum demands the ability to reconstruct user behavior timeline- proving exactly when programs were executed and files were accessed. This unit certifies the capability to turn raw disk images into a verified chronology of events.