The OpenText EnCase - Building an Investigation training course enhances the examiner's ability to work efficiently through the use of the unique features of EnCase. This course will build an investigation using analysis techniques, such as recovering volumes, registry analysis, and examining compound files. The course progresses through the analysis of Windows artifacts, shortcut link files, Recycle Bin, stored internet data, and email. This course will assist criminal, corporate, and cybersecurity analysts.
By attending OpenText EnCase - Building an Investigation workshop, delegates will learn to:
- Recover encrypted information particularly that which was encrypted using Windows BitLocker
- Locate and recover deleted partitions
- Deal with compound file types
- The Windows Registry
- Determine time zone offsets and properly adjust case settings
- Create and use conditions for effective searching
- Use the EnCase Evidence Processor
- Gain an overview of the FAT, ExFAT, and NT file system
- Conduct keyword searches and advanced searches using GREP
- The differences between single and logical evidence files and how to create and use of logical evidence files
- Identify Windows operating system artifacts, such as link files, Recycle Bin, and user folders
- Recover data from the Recycle Bin
- Recover artifacts, such as swap files, file slack, and spooler files
- Conduct a search for email and email attachments
- Examine email and Internet artifacts
- Identify and recover data relating to the use of removable USB devices
- Attend a training on OpenText EnCase Digital Forensics - Essentials or equivalent practical experience
The OpenText EnCase - Building an Investigation class is ideal for:
- Cybersecurity Professionals, Litigation Support & Forensic Investigators.