CPE credits: 32   |  Level: Advanced   |  Prerequisites: EnCase Computer Forensics II or EnCE Certification. Advance preparation for this course is not required.

This hands-on course is designed for examiners with advanced computer skills and two or more years of experience working in the field of computer forensics. Participants learn advanced data recovery techniques of artifacts in many of the file systems supported by EnCase. Delivery method: Group-Live. NASBA defined level: advanced.

Emphasis is placed on file system artifacts. This course provides in-depth coverage on topics including

• Students will recover NTFS artifacts in NT 4.0, Windows 2000, and Windows® XP
• Students will parse and examine the NTFS Registry
• Students will recover NTFS log files
• This course will address technical issues associated with NTFS file systems
• Students will learn about hardware and software RAIDs
• Students will learn the principles of encrypted data recovery
• Students will learn about Linux and Unix file system artifacts
• Students will learn how to recover Linux partitions
• Students will learn about Macintosh® file system artifacts
• This course will review and reinforce the EnCase Computer Forensic Methodology
• Students will learn advanced NTFS data recovery techniques
• Students will composing Filters, Conditions and Queries within EnCase

WHO SHOULD ATTEND

This course is intended for law enforcement officers, computer forensic examiners, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics is required. The class curriculum builds upon the foundation of the EnCase Computer Forensics II, continuing with a focus on file system examinations

Course Syllabus

---

Tuition is $2,995.00 per student
Government training rate is $1,995.00 per student