skip to main content

IR250 - Incident Investigation OnDemand

Have questions about training?   Contact us

Duration: 32 Hours

This OnDemand course focuses on the use of EnCase® Endpoint Investigator (EnCase) and other tools to acquire and analyze data in a manner that demonstrates the relevance of various file system, network, and memory-based artifacts in the context of an investigative scenario. Students will examine the different factors that affect incident investigations, including planning, basic forensic principles, and examination and response options. They will observe how failing to take note of important issues and implement suitable policies can lead to weaknesses in IT infrastructure and the loss of evidential data. Conversely students will learn to appreciate the benefits of forward planning, employee education, audit and event logging, and suitable access-control policies. This course is very much focused on the recovery of data for the purposes of an investigation and the context in which said data may prove valuable. Students will participate in practical exercises throughout the course to underscore and drive home the skills taught.

CPE Credits - 0


This entry-level course is intended for digital forensic investigators, including IT specialists, security analysts, DFIR practitioners, and traditional digital investigators. Participants should have Foundations level EnCase skills.


Participants should have attended the EnCase course, DF120 – Foundations of Digital Forensics or EnCase v7 Computer Forensics I (offered prior to June, 2016)


Students attending this course will learn the following:

  • Incident investigation/response considerations
  • How to capture disk and memory data using EnCase Endpoint Investigator and other tools
  • The significance of Windows Registry and file-system metadata, paying particular attention to the NT file system (NTFS) and timestamp analysis
  • How to identify and recover data encrypted using the Microsoft® Encrypting File System (EFS) and BitLocker®; also how properly applied group policies can help to recover said data and the potential significance of NTFS alternate data streams
  • The benefits of USN change log and ShellBag analysis and how they may complement one another
  • The significance and analysis of shortcut link files and jumplists
  • Windows event log and $LogFile analysis
  • Microsoft Windows® Recycle Bin mechanics and analysis
  • Examination of volume shadow copies
  • Memory analysis using Volatility; also the recovery of passwords, encryption keys, and other data from memory dumps
  • Determining the nature, identity, and provenance of files and folders using hash, signature, and USN change log analysis
  • Identification and recovery of artifacts from Internet Explorer, Edge, Firefox, and Chrome

Please note that this course touches on subjects covered by other EnCase Training courses, so attendees of those courses may experience a small overlap.


  • 1. A desktop/laptop computer.
    • Microsoft® Windows operating system is recommended.
  • 2. Internet access
  • 3. Latest Adobe® Flash Player software
  • 4. Latest Adobe Reader software
  • 5. Some courses offer the ability to conduct optional practical exercises on a remote workstation. Internet Explorer and Firefox are recommended.

***Passport students may only be registered in two (2) OnDemand courses concurrently

You are registering for an online class. EnCase OnDemand Courses can be accessed online 24/7.



Training materials for this course, including the ED165 - EnCase eDiscovery for the Legal Team OnDemand student manual, will be sent electronically. MANUALS ARE AVAILABLE ONLY ELECTRONICALLY. PHYSICAL COPIES OF MANUALS ARE NOT AVAILABLE WITH TRAINING OnDEMAND COURSES.

 Course Syllabus


Format Currency Price
Per Student at OpenText Site €  2,229.92 
Per Student at OpenText Site GBP  1,932.85 
Per Student at OpenText Site USD  2,495.00 

Taxes: All prices exclude VAT or other taxes where applicable (all currencies).

Extra expenses: Customer site course prices do not include instructor travel expenses, which are billed separately.

Reservations: Please provide a minimum of 3 weeks advance notice when arranging courses at customer sites.

Course & Workshop Calendar

Below is a listing of all the currently available dates and locations for this course or workshop from OpenText.

To register, please select the course you want to attend by clicking the "Add to cart" button.

Date Course type Course name Language Location Price Add
  Web-based  IR250 - Incident Investig  English  Web-based 2,495.00  Add to cart