EnCase® V6 Adv. Computer Forensics

From Date To Date Location Status Action
2010-10-19 2010-10-22 Toronto, Ontario Open Register
2011-02-08 2011-02-11 Toronto, Ontario Open Register

Location : Toronto, Ontario
Tuition : Limited time training offersfor corporate clients. FDR offers special tuition pricing and five different promotions to fit the needs of corporate clients. Call FDR at 250.382.9700 or email training@forensicdata.ca to obtain more information on these special limited time promotions and register for a course.


Corp $2,995USD; Gov $2,095USD (US residents attending training in Canada -HST Tax applied to cost of tuition)
Training Level : Advanced
Credits : 32
Objective : This live, hands-on course is designed for examiners with advanced computer skills and two or more years of experience working in the field of computer forensics. Participants learn advanced data recovery techniques of artifacts in many of the file systems supported by EnCase. Advanced preparation for this course is not required.
Course Syllabus
Who Should Attend : This course is intended for law enforcement officers, computer forensic examiners, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics is required. The class curriculum builds upon the foundation of the EnCase Intermediate Analysis and Reporting courses, continuing with a focus on file system examinations.
Prerequisites : EnCase® Intermediate Analysis and Reporting with V6 or EnCE Certification.
Note : Each student must bring their own laptop. Minimum laptop requirements will be provided at time of registration.

Emphasis is placed on file system artifacts. This course provides in-depth coverage on topics including
- Recovering NTFS artifacts in NT 4.0, Windows 2000, and Windows XP
- Parsing and examining the NTFS Registry
- Recovering NTFS log files
- Addressing technical issues associated with NTFS file systems
- Hardware and Software RAIDs
- Principles of encrypted data recovery
- Linux and Unix file system artifacts
- Recovering Linux partitions
- Macintosh file system artifacts
- Reviewing and reinforcing the EnCase® Computer Forensic Methodology
- Advanced NTFS data recovery
- Composing Filters, Conditions and Queries within EnCase


FDR is the authorized Canadian training partner for Guidance Software Inc., delivering EnCase® training in Canada. FDR's team of Guidance Software Inc. EnCase Certified Examiner (EnCE)-certified instructors have trained hundreds of students, supporting their skill development in computer forensics and progression to obtain their EnCE designation.

FDR Forensic Data Recovery Inc.

FDR - Canada's leader in digital investigations and eDiscovery professional services. FDR consistently supports best practices in the preservation, recovery, analysis and court-ready reporting of digital evidence.

Our unparalleled digital investigation expertise and 24/7 response capability assures our clients the most comprehensive, timely and cost-effective professional services.

Training Information

Course Schedule & Registration
Payment & Cancellation Policy
Training Delivery at Your Location

Contact FDR

Toll-free 1.866.381.9700

training@forensicdata.ca