EnCase® V6 Computer Forensics II

From Date To Date Location Status Action
2010-02-16 2010-02-19 Toronto, Ontario Full -
2010-03-23 2010-03-26 Toronto, Ontario Open Register
2010-06-01 2010-06-04 Toronto, Ontario Open Register
2010-09-21 2010-09-24 Toronto, Ontario Open Register
2010-11-02 2010-11-05 Toronto, Ontario Open Register
2010-12-07 2010-12-10 Toronto, Ontario Open Register

Location : Toronto, Ontario
Tution : Corp $2,995USD; Govt $1995USD (US residents attending training in Canada - 5% Goods & Services Tax applied to cost of tuition)
Training Level : Intermediate
Objective : This live course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the EnCase® forensic software. This course builds upon the skills covered in the EnCase® Computer Forensics I course and enhances the examiner's ability to work efficiently through the use of the unique features of EnCase®. Course Syllabus
Who Should Attend : Law enforcement officers, government and corporate computer forensic examiners. Participants should have attended the EnCase® Computer Forensics I course, or be familiar with all of the concepts covered in that course.
Pre-Requisities : EnCase® Computer Forensics I, or experience with using the EnCase® Forensic, with prior coursework in computer forensics. The EnCase® Computer Forensics II course should not be a student's first course in computer forensics, and students are expected to already have a good understanding of the File Allocation Table (FAT) file system. Advance preparation for this course is not required. EnCase® Computer Forensics I will be the entry point of training for all students. Course content covers EnCase features required to conduct basic investigations and create a report suitable for court presentation. Students knowledgeable of the core features covered in the EnCase Computer Forensics I course may enroll in the EnCase Computer Forensics II class. However, the essentials will no longer be reviewed in the intermediate course.
Note : FDR provides coffee/tea/water for breaks and cold sandwiches or pizza for lunch.

Focusing on investigations common to the government sector, the following are some of the topics covered during the four-day course:

- Creation and use of logical evidence files
- Locating and recovering deleted partitions and folders
- Conducting key word searches and advanced searches using GREP
- EnCase® Virtual File System (VFS) and Physical Disk Emulator (PDE)
- Windows Registry
- Dealing with compound file types
- Exporting files, directories and entire volumes
- Identifying files using hash values and building hash libraries
- Identifying Windows XP operating system artifacts such as link files, recycle bin, and user folders
- Preparing reports and evidence for presentation in court
- Recovering artifacts such as swap files, file slack, and spooler files
- Recovering printed and faxed pages

FDR is the exclusive Canadian training partner for Guidance Software Inc., delivering all EnCase® training in Canada. FDR's team of Guidance Software Inc. EnCase Certified Examiner (EnCE)-certified instructors have trained hundreds of students, supporting their skill development in computer forensics and progression to obtain their EnCE designation.

FDR Forensic Data Recovery Inc.

FDR - Canada's leader in digital investigations and eDiscovery professional services. FDR consistently supports best practices in the preservation, recovery, analysis and court-ready reporting of digital evidence.

Our unparalleled digital investigation expertise and 24/7 response capability assures our clients the most comprehensive, timely and cost-effective professional services.

Training Information

Course Schedule & Registration
Payment & Cancellation Policy
Training Delivery at Your Location

Contact FDR

Toll-free 1.866.381.9700

training@forensicdata.ca