Course Description

This hands-on course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the OpenText™ Forensic (EnCase). This course builds upon the skills covered in the DF120–Foundations in Digital Forensics course and enhances the examiner's ability to work efficiently using the unique features of OpenText Forensic. During this course, students will build an investigation using analysis techniques, such as recovering deleted volumes, registry analysis, Recycle Bin examination, and examining compound files. Other analysis techniques, such as searching unallocated clusters, parsing current Windows artifacts, examining email and internet artifacts, and analyzing USB device artifacts will be included.

Students must understand OpenText Forensic (EnCase) concepts, the structure of the evidence file, creating and using case files, and data acquisition and basic analysis methods. It is also important that the students are familiar with the methods for recovering deleted files and folders in a FAT environment, conducting indexed queries and keyword searches across logical and physical media, creating, and using bookmarks, file signature analysis, and exporting evidence.

Delivery method: Group-Live. NASBA defined level: intermediate.

CPE Credits - 32

Focusing on commonly conducted investigations, students will learn the following:

• How to identify and open a volume that was encrypted using Windows BitLocker™
• How to locate and recover deleted partitions
• How to deal with compound file types
• How to determine time zone offsets and properly adjust for the time zone in OpenText Forensic (EnCase)
• About the Windows® Registry
• How letters and numbers typed into a computer from a keyboard are translated into digital format
• About the NT file system and ExFAT through an overview of the systems
• How to identify Window system artifacts, such as the User folders, pagefile.sys, Recycle Bin, and other folders
• How to locate and examine shortcut files
• How to identify and recover data relating to the use of removable USB devices
• How to recover data from the Recycle Bin
• How to conduct a search for email and email attachments
• How to examine email and internet artifacts
• How to use Artifact Explorer to search, filter, tag, and bookmark artifact evidence
• How to employ GREP operators to enhance searching techniques
• How to employ the Media Analyzer during an investigation
• How to search and recover files from unallocated space
• How to use the Physical Disk Emulator (PDE) Module
• How to create reports to present investigation findings

Course Syllabus

Prerequisites

DF120 – Foundations in Digital Forensics with EnCase

Participants should have attended the OpenText course, DF120–Foundations in Digital Forensics.