FDR FORENSIC DATA RECOVERY INC. :

- • Computer Forensics
- • eDiscovery and ESI Preservation
- • Expert Witness Testimony
- • Data Recovery
- • Criminal Investigations
- • Case Studies
- • Theft of Intellectual Property
- • Public Speaking Engagements
- • Online Intelligence Services
- • Testimonials
- • Corporate Profile
- • Computer Forensics and Digital Investigation Experts
- • Affiliations
- • Memberships
- • Careers
- • Newsroom

EnCase® V6 NTFS

From Date	To Date	Location	Status	Action

Contact FDR for next available course date.

Location :	Toronto, Ontario
Tution :	Corp $2,995USD; Gov $2,095USD (US residents attending training in Canada -5% Goods & Services Tax applied to cost of tuition)
Training Level :	Expert
Credits :	32
Objective :	This live, hands-on course involves practical exercises and technical information about the NTFS file system. The class addresses the technical issues of the NTFS file system, including an in-depth analysis of the Master File Table (MFT) and its components. Students will locate and recover NTFS artifacts from the MFT and understand their evidentiary value. The course will delve into the NT Registry files for data identifying the computer user, installed applications and customized configurations. Students will recover encrypted passwords, identify alternate data streams, reparse points and mapped drives, identify security permissions for users, and determine if removable media was connected to a NTFS volume. In addition, students will examine partially wiped drives and recover files from partially wiped NTFS volumes.
Who Should Attend :	This course is intended for law enforcement officers, computer forensic examiners, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics and Internet related access is required. The class curriculum builds upon the foundation of the EnCase Intermediate Analysis and Reporting courses, continuing with a focus on NTFS file system examinations. Course Syllabus
Pre-Requisities :	EnCase® Computer Forensics II course, or EnCE Certification.Advance preparation for this course is not required.
Emphasis is placed on the meaning and relevance of the artifacts that administratively document the NTFS file system. The course provides in-depth coverage on artifacts involving: - Components of the NTFS Volume Boot Record and the Master File Table - Definitions and purpose of NTFS internal system files - Characteristics and storage of NTFS resident and non-resident attributes - Storage of alternate data streams and reparse points - Addressing NTFS user account information, encryption and file system security - Parsing and examining the NTFS registry - Linking media to an NTFS volume - Addressing technical issues associated with NTFS file systems - Advanced NTFS data recovery FDR is the exclusive Canadian training partner for Guidance Software Inc., delivering all EnCase® training in Canada. FDR's team of Guidance Software Inc. EnCase Certified Examiner (EnCE)-certified instructors have trained hundreds of students, supporting their skill development in computer forensics and progression to obtain their EnCE designation.

FDR Forensic Data Recovery Inc.

FDR - Canada's leader in digital investigations and eDiscovery professional services. FDR consistently supports best practices in the preservation, recovery, analysis and court-ready reporting of digital evidence.

Our unparalleled digital investigation expertise and 24/7 response capability assures our clients the most comprehensive, timely and cost-effective professional services.

Training Information

Course Schedule & Registration
Payment & Cancellation Policy
Training Delivery at Your Location

Contact FDR

Toll-free 1.866.381.9700

training@forensicdata.ca