EnCase® V6 Computer Forensics II

From Date To Date Location Status Action
2012-03-20 2012-03-23 Markham, Ontario Open Register
2012-04-24 2012-04-27 Ottawa, Ontario Open Register
2012-09-25 2012-09-28 Ottawa, Ontario Open Register
2012-10-16 2012-10-19 Markham, Ontario Open Register
2012-12-04 2012-12-07 Markham, Ontario Open Register

Tuition : $2,495.00 USD (US residents attending training in Canada -HST Tax applied to cost of tuition)
Training Level : Intermediate
Objective : This live course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the EnCase® forensic software. This course builds upon the skills covered in the EnCase® Computer Forensics I course and enhances the examiner's ability to work efficiently through the use of the unique features of EnCase®.
Course Syllabus
Who Should Attend : Law enforcement officers, government and corporate computer forensic examiners. Participants should have attended the EnCase® Computer Forensics I course, or be familiar with all of the concepts covered in that course.
Prerequisites : EnCase® Computer Forensics I, or experience with using the EnCase® Forensic, with prior coursework in computer forensics. The EnCase® Computer Forensics II course should not be a student's first course in computer forensics, and students are expected to already have a good understanding of the File Allocation Table (FAT) file system. Advance preparation for this course is not required. EnCase® Computer Forensics I will be the entry point of training for all students. Course content covers EnCase features required to conduct basic investigations and create a report suitable for court presentation. Students knowledgeable of the core features covered in the EnCase Computer Forensics I course may enroll in the EnCase Computer Forensics II class. However, the essentials will no longer be reviewed in the intermediate course.
Note : Each student must bring their own laptop. Minimum laptop requirements will be provided at time of registration.

Focusing on investigations common to the government sector, the following are some of the topics covered during the four-day course:

- Creation and use of logical evidence files
- Locating and recovering deleted partitions and folders
- Conducting key word searches and advanced searches using GREP
- EnCase® Virtual File System (VFS) and Physical Disk Emulator (PDE)
- Windows Registry
- Dealing with compound file types
- Exporting files, directories and entire volumes
- Identifying files using hash values and building hash libraries
- Identifying Windows XP operating system artifacts such as link files, recycle bin, and user folders
- Preparing reports and evidence for presentation in court
- Recovering artifacts such as swap files, file slack, and spooler files
- Recovering printed and faxed pages

FDR is the authorized Canadian training partner for Guidance Software Inc., delivering EnCase® training in Canada. FDR's team of Guidance Software Inc. EnCase Certified Examiner (EnCE)-certified instructors have trained hundreds of students, supporting their skill development in computer forensics and progression to obtain their EnCE designation.

FDR Forensic Data Recovery Inc.

FDR - Canada's leader in digital forensics products and training.  FDR consistently supports best practices in the preservation, recovery, analysis and court-ready reporting of digital evidence.

 

Training Information

Course Schedule & Registration
Payment & Cancellation Policy
Training Delivery at Your Location

Contact FDR

Toll-free 1.866.381.9700

training@forensicdata.ca