This certification validates demonstrated proficiency in Windows forensic investigation. The recipient successfully analyzed disk and memory images across a multi-system compromise, extracted and interpreted forensic artifacts, and documented findings in an evidentiary timeline aligned with investigative objectives under performance-based, real-world conditions using industry recognized forensic tools.