Course Description

This hands-on course involves practical exercises and real-life simulations in the use of OpenText™ Endpoint Investigator. The class provides participants with instruction on installing and configuring OpenText Endpoint Investigator and how to conduct previews, acquisitions, and searches. The course concludes with instruction on using bookmarking functionality to build a comprehensive case report.

Delivery method: Classroom. NASBA defined level: basic.

CPE Credits - 24

Students attending this course will learn the following:

• How to install and configure the Secure Authentication of EnCase (SAFE) server software.
• How to deploy the agent, which enables the examination of network nodes remotely.
• How to preview and acquire remote data, both at a physical (sector-by-sector) level and logically.
• How to preview and acquire physical memory (RAM) and capture a snapshot of volatile data, including open ports and running processes.
• How to preview and collect data using the Rapid Preview OpenText Endpoint Investigator functionality.
• How to collect data by using the Enhanced Agent.
• How to navigate, filter, sort, and search data shown in the OpenText Endpoint Investigator interface.
• How to use the Evidence Processor to identify email and internet artifacts.
• How to bookmark notable data and build a case report.

Course Syllabus

Prerequisites

Basic computer skills. Advance preparation for this course is not required.