EnCase® v6 Computer Forensics I on Nov 17-20, 2008 ,EnCase® v6 Computer Forensics II on Nov. 24-27, 2008

GlobalKnowledge Philippines Invites you to attend:

EnCase® v6 Computer Forensics I on Nov 17-20, 2008

Duration: 4 days, Monday to Thursday, 9am to 5pm

Venue: 25th Flr. Unit 2502b West Tower, Philippine Stock Exchange, Ortigas Center Pasig City

CPE credits: 32  

Level: Introductory  

Prerequisites: Basic computer skills. Advance preparation for this course is not required.

Delivery method: Group-Live & Instructor Led

Course Description: This hands-on course involves practical exercises and real-life simulations.

The class provides participants with an understanding of the proper handling of digital evidence from the initial seizure of the computer/media to acquisition, and then progresses to the analysis of the data. It concludes with archiving and validating the data.

Students attending this course will learn the following:

·         What constitutes digital evidence and how computers work

·         An overview of the EnCase Computer Forensic Methodology

·         Basic structures of the FAT and NTFS file systems

·         How to create a case and how to preview/acquire media

·         How to conduct basic keyword searches

·         How to analyze file signatures and view files

·         How to restore evidence

·         How to archive files and data created through analysis process

·         How to prepare evidence for presentation in court

·         How to verify the evidence file

Who Should Attend

This course is intended for IT security professionals, litigation support and forensic investigators Participants may have minimal computer skills and may be new to the field of computer forensics.

Outline:  

EnCase® v6 Computer Forensics II on Nov. 24-27, 2008

Duration: 4 days, Monday to Thursday, 9am to 5pm

Venue: 25th Flr. Unit 2502b West Tower, Philippine Stock Exchange, Ortigas Center Pasig City

CPE Credits: 32  

Level: Intermediate  

Delivery Method: Group-Live & Instructor Led

Prerequisites: EnCase® Computer Forensics I. Advance preparation for this course is not required.

Course Description: This hands-on course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the EnCase forensic software. This course builds upon the skills covered in the EnCase Computer Forensics I course and enhances the examiner's ability to work efficiently through the use of the unique features of EnCase.
*Students must understand evidence handling; the structure of the evidence file; creating and using case files; data acquisition methods including DOS based, hardware write protected, crossover cable and disk to disk; recovering deleted files and folders in a FAT environment; keyword searches across logical and physical media; creating and using EnCase bookmarks; file signatures and signature analysis; and locating and understanding Windows® artifacts.

Focusing on investigations common to the private sector, students will learn about the following:

·         How to create and use of logical evidence files

·         How to locate and recover deleted partitions and folders

·         How to conduct keyword searches and advanced searches using GREP

·         Students will gain an understanding of the EnCase Virtual File System (VFS) and Physical Disk Emulator (PDE)

·         Students will learn about the Windows® Registry

·         Students will learn how to deal with compound file types

·         How to export files, directories and entire volumes

·         How to identify files using hash values and building hash libraries

·         How to identify Windows XP operating system artifacts such as link files, recycle bin, and user folders

·         How to prepare reports and evidence for presentation in court

·         How to recover artifacts such as swap files, file slack, and spooler files

·         How to recover printed and faxed pages

 Who Should Attend

This course is intended for IT security professionals, litigation support and forensic investigators. Participants should have attended the EnCase Computer Forensics I.

Outline:

 TO REGISTER

Please call 683-0969 / 637-3657 and look for

Sandra Medalla

GLOBALKNOWLEDGE PHILIPPINES