Courses & Workshops

Have questions about training?     Contact us

DF410 - NTFS Examinations with EnCase®

Duration: 4 Days

This hands-on course involves technical information and practical exercises about the NT File System (NTFS). The class addresses the technical aspects of NTFS, including an in-depth analysis of the Master File Table ($MFT) and its components. Students will locate and recover valuable NTFS artifacts and understand their evidentiary value. The structure of the NTFS directory will be examined and parsed. Students will recover encrypted passwords, identify alternate data streams, identify security permissions for users, and determine if other storage media was connected to an NTFS volume through reparse points. In addition, students will examine a partially wiped drive and recover files from the partially wiped NTFS volume using their new knowledge and skills.

Delivery method: Group-Live. NASBA defined level: advanced

CPE Credits - 32

Audience

This course is intended for law enforcement officers, computer forensic examiners, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics and Internet-related access is required. The class curriculum builds upon the foundation of the EnCase® Computer Forensics II course, continuing with a focus on NTFS file system examinations.

Prerequisites

DF210 - Building an Investigation with EnCase or EnCE Certification. Advance preparation for this course is not required.

Summary:

The meaning and relevance of the artifacts that administratively document NTFS are emphasized.

The course provides in-depth coverage on artifacts, including:

  • Components of the NTFS Volume Boot Record and the Master File Table
  • Definitions and purpose of NTFS internal system files
  • Characteristics and storage of NTFS resident and non-resident attributes
  • Storage of alternate data streams and reparse points
  • Addressing NTFS user account information, encryption and file system security
  • Resolving Windows® Vista operating system symbolic links
  • Linking media to a NTFS volume
  • Addressing technical issues associated with NTFS
  • Advanced NTFS data recovery

Pricing

Format Currency Price
Per Student at Open Text Site €  2,227.50 
Per Student at Open Text Site GBP  1,952.50 
Per Student at Open Text Site USD  2,750.00 

Taxes: All prices exclude VAT or other taxes where applicable (all currencies).

Extra expenses: Customer site course prices do not include instructor travel expenses, which are billed separately.

Reservations: Please provide a minimum of 3 weeks advance notice when arranging courses at customer sites.

Course & Workshop Calendar

Below is a listing of all the currently available dates and locations for this course and/or workshop from Open Text.

Selection & Registration Process

Before you can register for a course or workshop, you need to select which one you want to attend. To do this, simply click on the "Add to cart" link and it will be added to your shopping cart.

Note: After clicking on the "Add to cart" link, you will be taken to the main course and workshop selection page where all of the courses and workshops you have added to your shopping cart will appear at the top of the page.

Once you have selected all the courses and workshops you want to attend, simply select the "Check-out link and complete the registration form.

Date Course Type Course Name Language Location Price Add
Oct 02, 2018  On-site  DF410 - NTFS Examinations  English  GSI-Reading 1,952.50  Add to Cart 
Oct 02, 2018  On-site  DF410 - NTFS Examinations  English  Virtual Classroom - Europe GSI UK Time 1,952.50  Add to Cart 
Oct 09, 2018  On-site  DF410 - NTFS Examinations  English  GSI-Pasadena 2,750.00  Add to Cart 
Oct 09, 2018  On-site  DF410 - NTFS Examinations  English  Virtual Classroom - North America GSI Pacific Time 2,750.00 

Almost Full

Add to Cart 
Jan 29, 2019  On-site  DF410 - NTFS Examinations  English  GSI-Reading 1,952.50  Add to Cart 
Jan 29, 2019  On-site  DF410 - NTFS Examinations  English  Virtual Classroom - Europe GSI UK Time 1,952.50  Add to Cart 
Feb 12, 2019  On-site  DF410 - NTFS Examinations  English  GSI-Pasadena 2,750.00  Add to Cart 
Mar 12, 2019  On-site  DF410 - NTFS Examinations  English  GSI-Washington, DC 2,750.00  Add to Cart 
Mar 12, 2019  On-site  DF410 - NTFS Examinations  English  Virtual Classroom - North America GSI Eastern Time 2,750.00  Add to Cart 
Apr 30, 2019  On-site  DF410 - NTFS Examinations  English  GSI-Reading 1,952.50  Add to Cart 
Apr 30, 2019  On-site  DF410 - NTFS Examinations  English  Virtual Classroom - Europe GSI UK Time 1,952.50  Add to Cart 
Jun 11, 2019  On-site  DF410 - NTFS Examinations  English  GSI-Pasadena 2,750.00  Add to Cart 
Jun 11, 2019  On-site  DF410 - NTFS Examinations  English  Virtual Classroom - North America GSI Pacific Time 2,750.00  Add to Cart