Students will review the body of knowledge required to perform computer forensics. This body of knowledge in the areas of computer science, computer forensic terminology, law, and familiarity with the EnCase® forensic tool is the core of the first phase (written examination) of the certification process.
On the final afternoon of the course, students will receive instructions for Phase I of the EnCE written exam. Students will then have 10 business days to log in and complete Phase I. The results of the written examination will be provided immediately following the completion of the examination, at which time those who achieved a passing score of 80% or more will also receive their practical examination.
During this course students actively use EnCase® Forensic v7 software to review the skill set required to address the EnCE practical examination, including:
- Basic EnCase® concepts and navigating within the EnCase® environment
- Creating and managing cases
- The proper handling and acquisition of evidence
- Creating evidence files
- Basic computer functions as well as that of various computer file systems
- Searching through evidence evidence and viewing and bookmarking the search results
- Conducting signature analyses of files and analyzing the resultant information
- Computing hash values, creating hash sets, and compiling hash libraries
- Recovering evidence from printed output and the Recycle Bin