Getting Started with SUSA

Set up your Windows workstation before installing the tools or working with evidence. Start with a virtual machine if you need a separate training environment. Then complete the steps below that apply to your setup.

1. 1Build
2. 2Enable
3. 3Configure
4. 4Organise

Choose your setup task

01 Create a Windows VM Install Windows in a virtual machine for the tools and training exercises. Install updates, check the network settings and take a clean snapshot. Start here if you need a separate lab 02 Install WSL Add a Linux environment for the guides that use Linux command line tools. Check that your distribution starts and that its packages can be updated. Optional · Required by some guides 03 Improve forensic visibility Configure Windows auditing and PowerShell logging in your training environment. Generate test activity and check that the expected events are recorded. Apply before starting the relevant exercises 04 Create tool shortcuts Make your frequently used tools easier to find and open. Check each shortcut against the installed executable and its working directory. Complete after installing the tools

Keep a record of your setup

Note the Windows version, VM resources, network settings and changes you make. Keep a clean snapshot so you can return to a known starting point. A snapshot does not replace a backup or isolate the VM from its network.

Recommended order

Create the Windows VM first, if you are using one. Install WSL only for guides that need it. Configure logging before generating test activity, and create shortcuts once the tools are installed in their final locations.