EnCase v7 Computer Forensics I & II Training

EnCase Computer Forensics I

Course fee: Php95,000.00 +12%VAT /person

Inclusive of: Training Materials, Certificate and AM/PM Snack and Lunch) & 32 CPE Credit

Venue: Ground Flr. Unit 107 Beacon Plaza, Shaw Blvd. Cor. Ideal St. Mandaluyong City, Philippines

Level: Introductory  

Prerequisites: Basic computer skills. Advance preparation for this course is not required.

Delivery method: Group-Live & Instructor Led; English Language

Course Description: This hands-on course involves practical exercises and real-life simulations. The class provides participants with an understanding of the proper handling of digital evidence from the initial seizure of the computer/media to acquisition, and then progresses to the analysis of the data. It concludes with archiving and validating the data.

Day 1

Day one starts with an introduction to EnCase® Forensic v6 and examination methodology. Attendees are shown how to use EnCase Forensic to acquire a complete copy of the data from a removable disk in a forensically sound manner. The concept of digital evidence and how computers work (paying particular regard to the associated impact on forensic examination) are also included.

Day 2

Day two expands upon the information provided in day one, and begins with a detailed discussion of the FAT file systems as well as an overview of the NT file system. Hard disk acquisition is covered, using both a forensically sound Linux CD, as well as the use of a hardware write-blocking device.. Attendees will learn how to properly preview a computer system prior to acquisition as well as explore keyword searching and bookmarking of relevant data.

Day 3

Day three includes more complex bookmarking of data. Instruction is given on the use of file signatures to properly identify file types. The principal and practical usage of digital fingerprints (hash value) to identify files of interest and exclude known files is also covered. Attendees will install external viewers within EnCase Forensic and learn how to copy data from within an evidence file. Restoring an evidence file back to physical media is also covered.

Day 4

Day four explores how to reacquire evidence in order to modify evidence-file parameters but still maintain data integrity. Attendees are given advice and guidance for archiving as well as instruction on how to restore and open an archived case. Attendees will observe first hand how EnCase Forensic can detect and identify any changes to the content of an evidence file. Practical instruction will then be given concerning the use of the Timeline viewer within EnCase Forensic and the recovery of deleted data from the unallocated space of a computer disk. Following this the importance of proper evidence handling will be discussed with the attendees being shown examples of good practice in this area.