EnCase Advanced Computer Forensics - Certified EnCase Training

This hands-on course is designed for examiners with advanced computer skills and two or more years of experience working in the field of computer forensics. Participants learn advanced data recovery techniques of artifacts in many of the file systems supported by EnCase. Delivery method: Group-Live. NASBA defined level: advanced.

Emphasis is placed on file system artifacts and will address technical issues associated with NTFS file systems. This course provides in-depth coverage on topics including:

- Students will recover NTFS artifacts in NT 4.0, Windows 2000, and Windows® XP
- Students will parse and examine the NTFS Registry
- Students will recover NTFS log files
- Students will learn about hardware and software RAIDs
- Students will learn the principles of encrypted data recovery
- Students will learn about Linux and Unix file system artifacts
- Students will learn how to recover Linux partitions
- Students will learn about Macintosh® file system artifacts
- Students will learn advanced NTFS data recovery techniques
- Students will composing Filters, Conditions and Queries within EnCase