DFA - Digital Forensics Advanced

Description

This 3-day advanced class will familiarize the student with the many artifacts left behind on a Windows NT platform. Operating systems analyzed include: Windows XP, Windows Vista, Windows 7, and Windows 8/10.

This course focuses on the traditional artifacts associated with normal operating system functions and user interactions. Detailed discussions focusing on operating system processes will lead to analysis of the artifacts left behind after normal user / system interaction.

Objectives

This course is designed to advance the skill set of forensic examiners by focusing on operating system artifact analysis and forensic processing.

Completing this class will enable forensic examiners to:

Find and analyze operating system and user interaction artifacts
Understand Windows directory structures, partition tables, and GUID tables
Learn best practices in dealing with Windows BitLocker encryption
Explore and understand advanced topics in operating system data structures including log files
Learn proper methods to access and conduct forensic analysis of shadow files and the Windows registry

Prerequisites

This hands-on course is geared toward forensic investigators with at least 6 months experience in forensic casework and with a basic understanding of Microsoft data structures.

To gain the maximum benefit from this course you should meet or exceed the following requirements:

Read and understand the English language
Have attended basic digital forensic training
Have previous investigative experience in forensic casework
Be familiar with the Microsoft Windows environment and data recovery concepts

Syllabus

Downloadable course syllabus

Schedule

No classes scheduled at this time.