{"permissions":{},"commerce":{"user_subscriptions":null,"subscription_plans":[{"id":234,"image":"https://cdn.filestackcontent.com/YSrnUha1Sna9l92OqDHi","school":5379,"page_body":"

The AND Skills Vault includes a collection of standalone lessons from AND course authors and contributors that will help you improve your forensic and analysis skills. New lessons are added monthly. An active subscription also retains access to any full length courses you've purchased and ensures you will receive course updates for as long as your subscription is active. Start or stop your subscription any time. For full details and an FAQ, see Networkdefense.co.\r\n

","giftable_cycles":"","name":"AND Skills Vault Monthly Subscription","amount":20.0,"plan":{"id":365,"amount":20.0,"interval":5,"trial_period_days":0,"trial_type":5},"resources_count":0,"url":"https://www.networkdefense.io/subscribe/","currency_display":"$20","currency_display_per_month":"$20","currency_display_giftable_cycles":{}},{"id":276,"image":"https://cdn.filestackcontent.com/YSrnUha1Sna9l92OqDHi","school":5379,"page_body":"

","giftable_cycles":"","name":"AND Skills Vault Yearly Subscription","amount":200.0,"plan":{"id":426,"amount":200.0,"interval":10,"trial_period_days":0,"trial_type":15},"resources_count":0,"url":"https://www.networkdefense.io/subscribe/","currency_display":"$200","currency_display_per_month":"$16.67","currency_display_giftable_cycles":{}}],"global_tracking_code":"","conversion_tracking_code":"\n<script src="//platform.twitter.com/oct.js" type="text/javascript"></script>\n<script type="text/javascript">twttr.conversion.trackPid('nxgvm', { tw_sale_amount: 0, tw_order_quantity: 0 });</script>\n<noscript>\n<img height="1" width="1" style="display:none;" alt="" src="https://analytics.twitter.com/i/adsct?txn_id=nxgvm&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />\n<img height="1" width="1" style="display:none;" alt="" src="//t.co/i/adsct?txn_id=nxgvm&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />\n</noscript>\n\n\n\n\n\n\n<script>\n gtag('event', 'conversion', {\n 'send_to': 'AW-779065575/jLMdCKTdhI8BEOexvvMC',\n 'transaction_id': ''\n });\n</script>\n\n\nwindow.lintrk('track', { conversion_id: 28675490 });","payment_requires_zip_code":false,"currency_code":"usd"},"media":{"image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FHPn6zYkRHSqgbWxVJ237%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&ixlib=python-1.1.0&w=500&s=67714604a0a4dd036627a0b24d864157","thumb":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FHPn6zYkRHSqgbWxVJ237%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=250&ixlib=python-1.1.0&w=250&s=dd186d13312ece08824791a21b8f85ac","logo":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FVKNMnAbVRN2MnGP7T3el%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&h=200&ixlib=python-1.1.0&w=600&s=7c723bb7aae5568e9780e3f7f30305ca","url":"https://pathwright-backend-static-production.s3.amazonaws.com/","theme":{"id":283,"name":"Applied Network Defense - 7600","description":"","primary_color":"0d71fb","background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FB8TQJqo9RoOCyIQVKYNa%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=cb76712ea91191b11d11e186e7c71b3d","heading_font":"","typekit_id":"","custom_css":"","processed_custom_css":"","theme_css_url":null,"typekit_scripts":null,"background_image_blurred_cdn":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FB8TQJqo9RoOCyIQVKYNa%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&h=250&high=-80&ixlib=python-1.1.0&q=100&w=250&s=cc0e89cbfefc213e7a79ec84bdb9f077","background_overlay":"0,0,0,0","background_type":1,"background_image_raw":"https://cdn.filestackcontent.com/B8TQJqo9RoOCyIQVKYNa","theme_type":50},"pages":[{"id":308,"name":"Courses","order":0,"url":"/p/course-list/","show_in_nav":true,"using_blocks":false,"page_type":10,"template_type":"open","is_live":true}]},"school":{"id":5379,"name":"Applied Network Defense","platform_version":2.2,"url":"https://www.networkdefense.io/","is_ssl_disabled":false,"is_curriculum_licensor":false,"is_curriculum_subscriber":false,"is_activated":true,"is_activated_via_override":false,"resource_licensing_enabled":false,"trial_has_expired":false,"trial_days_remaining":null,"is_curriculum_enabled":true,"has_public_resources":true,"billing_model_display":"PW2","billing_model":10,"website":"","has_certificate":true,"subdomain":"networkdefense","ietf_language_tag":"en-US","short_description":"Affordable, effective, online information security training. Made by analysts, for analysts.","has_consent_description":false},"support":{"has_faqs":false,"support_email":"chris@chrissanders.org","support_phone":"","support_link":"","support_policy":"

Course support is provided by e-mail. Most questions will be answered within 24 hours.

","support_faqs":null},"security":{"terms_of_service":"https://www.networkdefense.io/pages/terms-of-use.html","privacy_policy":"https://www.networkdefense.io/pages/privacy-policy.html","csrf_token":"tab7UMGbjkPu4NWuMl8RVGQwhmnmZ21AMYv4jZYnKPld9qkOabT2AL8BTRvYr8EM","terms_agreement_prompt_override":""},"social":{"twitter_username":"","facebook_username":"","google_plus_username":"","pinterest_username":""},"integrations":{"facebook":null,"filepicker":{"read_policy":"eyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0=","read_signature":"888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34"},"algolia":false,"intercom":{"user_hash":null,"app_id":null,"school_app_id":null,"school_staff_app_id":null,"pathwright_app_id":"5txzvi2k","school_profile":null},"stripe":{"publishable_key":"pk_live_519FnuiJS0AkKge1QE3m8gmgfw8ZrTaMQm65TH1hqecGkb8CtFjnUtdNniNz6X1rIp4p7MIv5T3J3phpIzYcVTlch007NgYwdpy"},"firebase":null,"google_analytics":{"account_id":"G-999PV44WV0","domain_name":"pathwright.com"},"sso":{"pathwright_login_enabled":true,"providers":[],"current_provider":null}},"customizations":{"head_markup":["","\n\n\n\n\n\n\n\n\n\n\n"],"script_markup":["\n\n\n","\n\n"],"global_tracking_code":""},"pathwright_account":{"is_on_legacy_plan":false,"is_activated":true,"payment_key":"pk_live_1EFaBZz7SRVXYhX7V70P4dhCC2tOEVWu0f6r3WNUvnxmc3lGpxhOlp3CIPzgfFjihpeAG08yyda1lpRhIINEScEPn00qXGNBhT6","subscription":{"id":909,"school":5379,"plan":{"id":72,"name":"Complete + SSO Monthly Plan","image":null,"description":"Complete ($499/month) + SSO ($299/month)","amount":798.0,"fee_per_additional_learner":0.0,"features":{"10-staff-members":true,"offer-multiple-subscription-plans":true,"course-certificates":true,"1-staff-member":true,"start-at-1000-active-learners":true,"friendly-email-support":true,"starts-with-5-staff-members":true,"sell-subscriptions":true,"free-course-design-courses":true,"use-your-own-domain-name":true,"member-created-group-courses":true,"priority-email-support-live-demos":true,"create-unlimited-courses":true,"add-more-members-and-staff":true,"sell-courses-with-commerce":true,"1-cohort-per-course":true,"essential-app-integrations":true,"guided-course-design-courses":true,"priority-email-support":true,"3-cohorts-per-course":true,"Unlimited-cohorts-per-course":true,"1-mentor-group":true,"5-mentor-groups":true,"20-mentor-groups":true,"sign-in-with-apple-or-google":true},"plan_order":3,"plan_color":"","visibility":15,"learners_included":1000,"should_contact_for_pricing":false,"intervals_by_month":[{"interval_id":5,"months":1,"amount_per_cycle":798.0,"amount_per_month":798.0,"discount_percent":0.0,"discounted_amount_per_month":798.0,"discounted_amount_per_cycle":798.0,"discount_per_month":0,"discount_per_cycle":0},{"interval_id":7,"months":6,"amount_per_cycle":4788.0,"amount_per_month":798.0,"discount_percent":0.05,"discounted_amount_per_month":758.0,"discounted_amount_per_cycle":4548.0,"discount_per_month":40,"discount_per_cycle":240},{"interval_id":10,"months":12,"amount_per_cycle":9576.0,"amount_per_month":798.0,"discount_percent":0.1,"discounted_amount_per_month":718.0,"discounted_amount_per_cycle":8616.0,"discount_per_month":80,"discount_per_cycle":960},{"interval_id":20,"months":1,"amount_per_cycle":798.0,"amount_per_month":798.0,"discount_percent":0.0,"discounted_amount_per_month":798.0,"discounted_amount_per_cycle":798.0,"discount_per_month":0,"discount_per_cycle":0}],"scholarships_available":false},"subscription":{"id":34550,"card_last_4":"0324","subscription_plan":{"id":287,"amount":798.0,"interval":5,"trial_period_days":0,"trial_type":null},"is_delinquent":false,"cycle_start_dtime":"2026-10-11T16:03:37-04:00","cycle_end_dtime":"2026-11-11T15:03:37-05:00","canceled_dtime":null,"provider_school_stripe_key":null,"trial_type":null,"trial_end_dtime":null,"paused_until_dtime":null,"is_canceled_at_cycle_end":false,"cancellation_reason":null},"interval":5}},"user":null,"session":{"user":null,"school_membership":null,"csrf_token":"5Hpyf0MaEW9igFtRfBNqU1Ec0o4ZXMZGovJvEd4m5rF1liRbDryBz6WhCTcBpSCS","is_authenticated":false},"DEBUG":false,"resource":{"id":241538,"name":"Browser Forensics for Security Analysts","description":"

Turn browser artifacts into investigative answers.\n

The web browser is one of the richest sources of evidence on a modern computer. It can tell you where a user went, what they searched for, what they downloaded, how they arrived at a page, what they entered into websites, and what happened while they were there.\n

But browser forensics is about more than finding a history database and extracting URLs.\n

Modern browsers store an enormous amount of information across history records, cookies, caches, permissions, downloads, form data, IndexedDB, private file systems, and other artifacts. The challenge isn’t simply knowing these artifacts exist; it’s knowing which evidence can answer your investigative question and how to put that evidence together.\n

Introducing….\n

Browser Forensics for Security Analysts teaches you how to examine and correlate artifacts to reconstruct browsing activity and answer critical investigative questions. With a focus on Google Chrome, this course gives you a practical foundation rooted in real-world analysis skills.\n

Rather than memorizing artifact locations and database schemas, you’ll learn browser artifacts in the context of realistic investigative questions. You’ll reconstruct browsing activity, examine how websites store data, investigate suspicious downloads and phishing activity, and use browser evidence to understand user behavior.\n

You’ll also go beyond individual artifacts by correlating evidence across multiple sources. That’s where browser forensics becomes especially powerful: a URL tells you one thing, but navigation history, cached resources, downloads, permissions, and stored website data can tell you the story of what actually happened.\n

You’ll Learn How to Answer…

User Actions

What pages were visited in a browser?
How did the user get to this particular page?
What did the user type into a form field?
What permissions did the user grant websites?

Identity and Devices

What account is associated with a browser profile?
What accounts were used in a browser?
What device did the activity occur on?
What person was using a browser at a particular time?

Website Actions

What cookies were used by a website?
What files were cached by a website?
What temporary and persistent key/value pairs did a website save?
What notifications did a website display?

Browser Extensions

What extensions are installed?
What can this extension do?
What did the extension do?
What data is the extension saving?

Browser-Based Attacks

Was the user phished?
What scripts loaded on a page visit?
Did the user exfiltrate any data?
I keep seeing these pop-ups; is my computer infected?
Did the user download and run malware?

Pattern of Life Behaviors

What sites does the user visit most frequently?
What browsing activity happened outside of “typical” hours?
How can we describe browsing \"sessions\" and highlight unusual ones?

If you want to learn how to use browser evidence to reconstruct what users, attackers, and malware actually did… Browser Forensics for Security Analysts is the course you’re looking for.\n

Browser Forensics for Security Analysts includes:\n

Over 15 hours of demonstration videos. These videos will break down the concepts and skills you need to investigate browser-based behavior.\n

Hands-on labs to help you develop and test your skills. You’ll complete lab exercises by following along with class demonstrations and analyzing real security data in course exercises. I’ll be with you along the way to provide guidance and feedback on your work.\n

Participation in our student charitable profit-sharing program. A few times a year, we designate a portion of our proceeds for charitable causes. AND students can nominate charities that matter to them to receive these donations.\n

Frequently Asked Questions

Is this course live?
This is NOT a live course. It’s an online video course you can take at your own pace. You’ll interact with the instructor asynchronously through the course exercises.\n

How long do I have access to the course material?
You have access to the course for six months following your purchase date. If you need more time, you can extend your access for a small monthly fee.\n

Are there any prerequisites or lab requirements for this course?
This course is designed for all security practitioner skill levels and assumes no prior browser forensic experience. You should have some basic knowledge of forensic/incident response processes. To follow along with the labs, you should ...\n

How much time does it take to do this course?
Given the number of lab exercises, completing the course takes people varying amounts of time. You can plan for around 15 hours of lecture and demonstration lessons and 5-8 hours for lab exercises on your own. We recommend spreading your time in the course out over at least a few weeks to benefit from the effects of spaced learning.\n

How many CPEs/CMUs is this course worth?
Organizations calculate continuing education credits in different ways, but they are often based on the length of the training. This course averages 20 hours of video+lab work.\n

Do you offer discounts for groups from the same organization?
Yes. To inquire about discounts or group invoices, please contact us at info@appliednetworkdefense.com.\n

","short_description":"Learn how to use browser evidence to reconstruct user, attacker, and malware activity during security investigations","categories":[{"id":952,"name":"Information Technology","slug":"information-technology","description":null,"order":0,"resources_count":null},{"id":2727,"name":"Computer Security","slug":"computer-security","description":"","order":0,"resources_count":null}],"image":null,"cover_image":"https://cdn.filestackcontent.com/gzWS3zuZSkyIuRXi9lhy","thumb":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FgzWS3zuZSkyIuRXi9lhy%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?dpr=1&fit=crop&h=232&ixlib=python-1.1.0&w=310&s=e7d8ac710c86be17f702e02b2b1c177d","thumb_2x":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FgzWS3zuZSkyIuRXi9lhy%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?dpr=2&fit=crop&h=232&ixlib=python-1.1.0&w=310&s=8ddfbf1934c16b242f35cbaf9d15f0c5","icon":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FgzWS3zuZSkyIuRXi9lhy%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=35&ixlib=python-1.1.0&w=35&s=e54a189366da403076161b820cd0aee3","background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FgzWS3zuZSkyIuRXi9lhy%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&high=-80&ixlib=python-1.1.0&q=100&w=1400&s=9f973cc69f39376fe3b2cad25debf62c","background_overlay":null,"background_image_blurred_cdn":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FgzWS3zuZSkyIuRXi9lhy%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&h=250&high=-80&ixlib=python-1.1.0&q=100&w=250&s=5a81916742eb3794e31b047c53c9895d","background_type":5,"authors":[{"id":8564,"display_name":"Ryan Benson","first_name":"Ryan","last_name":"Benson","bio":"","image":null,"resources_count":null,"salutation":"","title":"","slug":"ryan-benson","order":0,"avatar":""}],"created":"2025-12-10T09:11:52.738918-05:00","url":"https://www.networkdefense.io/library/browser-forensics-for-security-analysts-241538/","offering_counts":{},"resource_type":10,"resource_type_display":"Course","slug":"browser-forensics-for-security-analysts-241538","trailer_embed_code":"","list_order":null,"total_registration_count":null,"sum_registration_count":4,"lowest_public_offering_price":247.0,"highest_public_offering_price":247.0,"curriculum_offering":null,"num_offerings":1,"visibility_level_override":null,"licensing_enabled":false,"license_offerings":[],"licensed_from_resource":null,"certificate_generator_class":"","lowest_price_currency_display":"$247","highest_price_currency_display":"$247","discussion_enabled":true,"licensed_from_school":null,"highest_visibility_level":15,"certificate_json":{}},"offering":{"id":779235,"name":"Browser Forensics for Security Analysts","access_starts":null,"access_ends":null,"enrollment_starts":"2026-11-10T00:00:00-05:00","enrollment_ends":null,"description":"","visibility":15,"price":247.0,"seats":null,"seats_filled":1,"seats_available":-1,"currency_display":"$247","include_in_subscription_plans":[],"include_with_products":[],"is_subscription_only":false,"resource_id":241538,"path_id":11488546,"permissions":{"can_participate":false,"can_access":false,"can_edit":false,"can_edit_resource":false,"can_facilitate":false,"can_view_analytics":false,"can_invite_editor":false,"can_invite_teacher":false,"can_invite_moderator":false,"can_invite_student":false,"can_invite_observer":false},"due_dates_enabled":false,"is_group_offering":false,"step_counts":{},"is_curriculum":false,"url":"/library/browser-forensics-for-security-analysts-241538/779235/","invite_urls":{},"access":{"is_full":false,"has_registration_ended":false,"has_registration_started":false,"has_access_started":true,"has_access_ended":false},"analytics_visibility":5,"resource_license":null,"discussion_enabled":true,"parent_offering_id":null,"created_by_id":74872,"status":1,"analytics_disabled":false}}

Loading Browser Forensics for Security Analysts...