Course Overview
This hands-on course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the OpenText™ EnCase™ software (EnCase). This course forms upon the skills covered in the DF120–Foundations in Digital Forensics course and enhances the examiner's ability to work efficiently using the unique features of EnCase. During this course, students will build an investigation using analysis techniques, such as recovering deleted volumes, registry analysis, Recycle Bin examination, and examining compound files. Other analysis techniques, such as searching unallocated clusters, parsing current Windows artifacts, examining email and Internet artifacts, & analyzing USB device artifacts will be included.
Learners must understand EnCase Forensic concepts, the structure of the evidence file, creating and using case files, & data acquisition and basic analysis methods. It is also essential that the learners are familiar with the tactics for recovering deleted files & folders in a FAT environment, conducting indexed queries & keyword searches across logical & physical media, creating, & using EnCase bookmarks, file signature analysis, and exporting evidence.
Prerequisites
● DF120 – Foundations in Digital Forensics with EnCase
● Participants should have attended the EnCase course, DF120–Foundations in Digital Forensics.
Audience Profile
This course is developed for cybersecurity professionals, litigation support, and forensic investigators.
Learning Objective
Refer course overview
Content Outline
● How to identify and open a volume that was encrypted using Windows BitLocker™
● How to locate and recover deleted partitions
● How to deal with compound file types
● How to determine time zone offsets & properly adjust for the time zone in EnCase
● About the Windows® Registry
● How to create and use conditions for effective searching
● About the ExFAT and NT file system through an overview of the systems
● How to identify Window system artifacts, such as the User folders, pagefile.sys, Recycle Bin, and other folders
● How to locate and examine shortcut files
● How to identify & recover data relating to the utilization of removable USB devices
● How to recover data from the Recycle Bin
● How to conduct a search for email and email attachments
● How to examine email and Internet artifacts
● How to employ the EnCase Media Analyzer during an investigation
● How to employ GREP operators to enhance searching techniques
● How to recover artifacts from the print spooler
● How to search and recover files from unallocated space
● How to use the EnCase Physical Disk Emulator (PDE) Module
● How to create reports to present investigation findings
FAQs
A: To attend the training session, learners should have operational Desktops or Laptops with the needed specifications and a decent internet connection to access labs.
A: We would always suggest you attend the live session to practice & clarify the doubts instantly & get more value from your investment. However, due to some contingency, if you have to skip the class, Radiant Techlearning will help you with the recorded session of that specific day. However, those recorded sessions are meant only for personal consumption & NOT for distribution or commercial use.
A: Radiant Techlearning has a data center with a Virtual Training environment for the learners.
Participants can easily access these labs over Cloud with the help of a remote desktop connection.
Radiant virtual labs allow you to learn from anywhere, globally, and in any time zone.
A: The individuals will be enthralled as we engage them in real-world & industry Oriented projects during the training program. These projects will enhance your skills and knowledge & you will gain a better experience. These real-time projects will assist you a lot in your future tasks & assignments.
A: Radiant Telelearning offers customized solutions and training programs for individuals, teams & businesses depending on their needs. Here is how we assist each one through our diverse formats.
Individuals / One-O-One Training
● Focused learning sessions
● Programmed scheduling according to your choice
● Get personalized attention
Opt what technology interests you
● Teams- Enroll for our Online public or Classroom batches
● Get our specialized updated content for various skill levels
● Get on-demand learning & solve problems quickly
● Get assistance from the ground level through sequential learning
Enterprise:
● Get customized training programmed and solutions that can be curated for your business
● Meet the requirements of all learners
● Let your workforce be geared up for all kinds of problem-solving
● Inspire your teams for future
● Update your workforce with the latest information from technology and business leadership to marketing.
A: Radiant Telelearning has a large pool of in-house certified trainers & consultants with solid backgrounds and working experience in the technology.
Radiant Telelearning offers more than 800+ courses & for each course, Radiant has identified ideal-in-class instructors.
Radiant has highly intensive selection criteria for Technology Trainers & Consultants who provide you with training programs. Our trainers & consultants undergo a rigorous technical & behavioral interview & assessment process before they are boarded in our company.
Our Technology experts/trainers & consultants carry a deep-dive understanding of the technical subject & are certified by the OEM. Our faculty will deliver you the knowledge of each course from the basic level in an easy way & you are free to ask your doubts any time from your respective faculty.
Our trainers have the patience & ability to explain complex concepts in a simplistic way with depth & width of knowledge.
A: Radiant believes in a practical & creative approach to training & development, distinguishing it from other training & development platforms. Moreover, training courses are undertaken by experts with a wide range of experience in their domain