1 (888) 999-9712   |    Customer Service   |    Customer Portal
Course Overview
    This hands-on course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the EnCase forensic software. This course builds upon the skills covered in the EnCase Computer Forensics I course and enhances the examiner's ability to work efficiently through the use of the unique features of EnCase.
    *Students must understand evidence handling; the structure of the evidence file; creating and using case files; data acquisition methods including DOS based, hardware write protected, crossover cable and disk to disk; recovering deleted files and folders in a FAT environment; keyword searches across logical and physical media; creating and using EnCase bookmarks; file signatures and signature analysis; and locating and understanding Windows® artifacts.
    Focusing on investigations common to the private sector, students will learn about the following:
CPE Credits
    0
Training Level
    Intermediate
Prerequisite
    Advance preparation for this course is not required.
Who Should Attend
  • This course is intended for IT security professionals, litigation support and forensic investigators Participants may have minimal computer skills and may be new to the field of computer forensics.
Tuition
  • Tuition is $1,695.00 USD plus shipping per student.
  • See Class Details for Actual Tuition Costs
    How to create and use of logical evidence files
    How to locate and recover deleted partitions and folders
    How to conduct keyword searches and advanced searches using GREP
    Students will gain an understanding of the EnCase Virtual File System (VFS) and Physical Disk Emulator (PDE)
    Students will learn about the Windows® Registry
    Students will learn how to deal with compound file types
    How to export files, directories and entire volumes
    How to identify files using hash values and building hash libraries
    How to identify Windows XP operating system artifacts such as link files, recycle bin, and user folders
    How to prepare reports and evidence for presentation in court
    How to recover artifacts such as swap files, file slack, and spooler files
    How to recover printed and faxed pages


SELECT LOCATION  SELECT DATE COURSE INFORMATION

DIRECTIONS
For more information regarding refund concerns and program cancellation policies, contact Guidance Software Training at training@guidancesoftware.com or call 626.229.9191 ext. 566.
Products
EnCase® Forensics
EnCase® Portable
EnCase® Enterprise
EnCase® eDiscovery
EnCase® Cybersecurity
Tableau Forensic
Services
Advisory Program
Implementation
Casework
Staff Augmentation
Data Mapping
Security Assessment

Training
Training Overview
Course Offerings
Certification Programs
Annual Training Passport
On-Site Training


Resources
Webinars & Demos
Whitepapers & Briefs
Real eDiscovery Mag
EnCase® Legal Journal
Guidance Software
About Us
Newsroom
Careers
Investors
Contact Us



© 2012 Guidance Software, Inc.
All Rights Reserved
Privacy Policy | Site Map