This is a five-day course is designed for the investigator/examiner entering the field of digital forensics and provides the fundamental knowledge to comprehend and investigate incidents involving electronic devices. The course covers in depth architecture and functionality of the NTFS and FAT File Systems and their related metadata pertaining to stored objects on the physical media. Attendees will gain insight into partitioning structures and disk layouts and the effects of formatting volumes that contain existing data. File management and directory structure characteristics will be examined in detail as well as techniques for discovering potential evidence that maybe pivotal to a successful examination. This will be followed by topical areas of interest to include file headers and file hashing and recovery of deleted files and basic analysis of a windows-based system. This course incorporates an investigative scenario, providing hands-on experience with examination of collected evidence

What You Will Learn

What is Digital Forensics

General overview of the world of digital forensic investigations.

Reasons for a Forensic Investigation

Discussions on the events that would lead to a request for a forensic examination.

Discuss the types of forensic analysis

Outline the different types of analysis the examiner will encounter Discuss the challenges of each and questions that need to be asked before an examination begins
Describe the forensic and incident response process.

Incident Response Process

Discuss the role of the first responder Outline the stages of the incident response Review best practices in evidence collection Concepts of a digital fingerprint, HASHing Discussions in evidence recovery.