DF320 - Advanced Analysis of Windows Artifacts with EnCase

Duration: 4 Days

**Formerly EnCase Advanced Computer Forensics

This hands-on course is designed for examiners with solid computer skills, seeking to learn advanced concepts in analyzing Windows artifacts. The participants will be provided instruction that includes parsing and analysis techniques on registry data, volume shadow service, random access memory, zip file structures, prefetch, and SQLite content.

Delivery method: Group-Live. NASBA defined level: advanced.

CPE Credits - 32

This course provides in-depth coverage on topics, including:

• Understanding SQLite databases and querying their data
• Recovering deleted SQLite data
• The use of block-based file hash analysis for file recovery
• Examination of the Microsoft Windows Registry
• Analyzing Userassist and ShellBag registry data
• The purpose and function of prefetch files and how to analyze them
• Analyzing Windows system databases
• Understanding and examination of the Windows timeline
• Understanding and examining of the System Resource Usage Monitor Database
• Identifying Windows notifications and how they can be customized
• Understanding how the system resource usage monitor is implemented
• Examination and recovery of Windows event logs
• Examination of Volume Shadow Copy (VSC) and File History data
• Identification and recovery of encrypted data
• Understanding how BitLocker is implemented and the options for recovery and searching
• Examination RAM using MemProcFS
• Low-level data recovery from Zip files and the latest version of Microsoft Word documents
• Hardware and software RAID technology, acquisition, and examination

Course Syllabus

Audience

This course is intended for law enforcement officers, corporate and private investigators, computer forensic examiners, and network security personnel. A basic understanding of the concepts of computer forensics is required. The class curriculum builds upon the curriculum included in the DF210-Building an Investigation course, continuing with a focus on file and operating system examinations.

Prerequisites

DF210 - Building an Investigation with EnCase or EnCE Certification.