DF320 is a 4-day advanced training course focused on analyzing Windows artifacts using EnCase forensic software. The course provides hands-on instruction for digital forensic examiners with existing EnCase experience, covering advanced parsing and analysis techniques for Windows systems. The curriculum includes examination of SQLite databases with data recovery capabilities, block-based file hash analysis for file recovery, and comprehensive Microsoft Windows Registry analysis including Userassist and ShellBag data. Students learn to analyze prefetch files, Windows system databases, Windows timeline, and System Resource Usage Monitor Database. The course covers examination and recovery of Windows event logs, Volume Shadow Copy and File History data, and encrypted data including BitLocker implementation and recovery options. Students receive training on RAM examination using MemProcFS, low-level data recovery from Zip files and Microsoft Word documents, and hardware/software RAID technology acquisition and examination. The training is designed for law enforcement officers, corporate and private investigators, computer forensic examiners, and network security personnel. Prerequisites include completion of DF210 Building an Investigation with EnCase or EnCE Certification. The course awards 32 CPE credits and is classified as NASBA advanced level.