CPE credits: 32   |  Level: Introductory to Intermediate   |  Prerequisites: EnCase® Computer Forensics II or EnCE Certification. Advance preparation for this course is not required.

Note: Advance preparation for this course is not required.

This hands-on course is designed for investigators with significant computer skills who want to expand their knowledge of examining live computers, networks, and servers. The class combines forensic examinations with live response in a network environment. Students learn to use the Field Intelligence Model (FIM)/Mobile EE software to examine a server to obtain evidence that may exist or be interpreted only while the server or network is running. Students also learn how to deploy the FIM/Mobile EE and conduct a forensic examination of a remote computer on the Internet. Delivery method: Group-Live. NASBA defined level: basic to intermediate.

Emphasis is placed on the access and acquisition of data from live machines running a variety of operating systems and file systems, and on overcoming myriad obstacles to obtain investigative information. The course provides in-depth coverage on topics including:

• Understanding fundamental operations of the FIM/Mobile EE
• Servlet pushing technologies: how to deploy the FIM/Mobile EE on servers and networks
• Troubleshooting a FIM/Mobile EE deployment
• Understanding firewalls
• Live RAM investigations
• Live forensic Linux examinations
• Using the FIM/Mobile EE snapshot—identifying open ports, open files, processes and device logons on a live machine
• Public Key Infrastructure and Virtual Private Network
• Introduction to cryptology
• Examining encrypted volumes
• Introduction to hubs, switches, routers and networking
• Understanding port numbers and open ports
• MAC addresses and their evidentiary significance
• Networking Essentials, Port Forwarding. Deploy FIM on a virtual network

WHO SHOULD ATTEND

This course is intended for law enforcement officers, computer forensic examiners, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics, networking fundamentals and the Internet is helpful. The class curriculum builds upon the foundation of the EnCase Intermediate Analysis and Reporting courses, with a focus on live network communication examinations.

Course Syllabus

---

Tuition is $2,995.00 per student
Government training rate is $1,995.00 per student