Facebook Twitter Linked In
 

Sessions:
EnCase Computer Forensics II
Guidance Software
Sorry there are currently no sessions scheduled for EnCase Computer Forensics II.
Please let us know you are interested in this course.

Fulcrum Training Vendors
 
Training
 
EnCase Computer Forensics II

This on demand online course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the EnCase® Forensic (EnCase). This course builds upon the skills covered in the EnCase® Computer Forensics I course and enhances the examiner's ability to work efficiently through the use of the unique features of EnCase. 

Students must understand evidence handling, the structure of the evidence file, creating and using case files, and data acquisition methods, including DOS-based, hardware write protected, crossover cable, and disk-to-disk. It is also important that the students are familiar with the methods for recovering deleted files and folders in a FAT environment, conducting keyword searches across logical and physical media, creating and using EnCase® bookmarks, file signatures and signature analysis, and locating and understanding Windows® artefacts.

(Not available from Fulcrum Asia)

Focusing on commonly conducted investigations, students will learn about the following:

  • How to recover encrypted information particularly that which was encrypted using Windows BitLocker™
  • How to locate and recover deleted partitions
  • Students will learn how to deal with compound file types
  • Students will learn about the Windows® Registry
  • How to determine time zone offsets and properly adjust case settings
  • How to create and use conditions for effective searching
  • Students will learn how to use the EnCase® Evidence Processor
  • Students will gain an overview of the FAT, ExFAT, and NT file system
  • How to conduct keyword searches and advanced searches using GREP
  • The differences between single and logical evidence files and how to create and use of logical evidence files
  • How to identify Windows operating system artifacts, such as link files, Recycle Bin, and user folders
  • How to recover data from the Recycle Bin
  • How to recover artifacts, such as swap files, file slack, and spooler files
  • How to conduct a search for e-mail and e-mail attachments
  • Students will learn how to examine e-mail and Internet artifacts
  • How to identify and recover relating to the use of removable USB devices

   Level: Intermediate.

Sorry - there are no sessions available to book.
 
Contact us
Australia:+61 (0)2 8012 9810
Singapore:+65 9297 1289
Customer Service:
Technical Support:
Training Bookings:
 
Register For the Fulcrum Newsletter HERE

© Fulcrum Management 2012
Name
Email
Organisation
Phone
Verification Code:
Name
Email
Organisation
Phone
Verification Code: