Course Description

**Formerly EnCase Advanced Computer Forensics

This hands-on course is designed for examiners with solid computer skills, seeking to learn advanced concepts in analyzing Windows artifacts. The participants will be provided instruction that includes parsing and analysis techniques on registry data, volume shadow service, random access memory, zip file structures, prefetch, and SQLite content.

Delivery method: Group-Live. NASBA defined level: advanced.

CPE Credits - 32

This course provides in-depth coverage on topics, including:

• Understanding SQLite databases and querying their data
• Recovering deleted SQLite data
• The use of block-based file hash analysis for file recovery
• Examination of the Microsoft Windows Registry
• Analyzing Userassist and ShellBag registry data
• The purpose and function of prefetch files and how to analyze them
• Analyzing Windows system databases
• Understanding and examination of the Windows timeline
• Understanding and examining of the System Resource Usage Monitor Database
• Identifying Windows notifications and how they can be customized
• Understanding how the system resource usage monitor is implemented
• Examination and recovery of Windows event logs
• Examination of Volume Shadow Copy (VSC) and File History data
• Identification and recovery of encrypted data
• Understanding how BitLocker is implemented and the options for recovery and searching
• Examination RAM using MemProcFS
• Low-level data recovery from Zip files and the latest version of Microsoft Word documents
• Hardware and software RAID technology, acquisition, and examination

Course Syllabus

Prerequisites

DF210 - Building an Investigation with EnCase or EnCE Certification.