DFIR350 - Internet-based Investigation with EnCase

Duration: 4 Days

**Formerly EnCase Advanced Internet Examinations

This hands-on course involves the examination of application data pertaining to Internet-based investigations. The analysis techniques include recovering and accessing evidence pertaining to peer-to-peer software, various Internet browsers, website data, and email. Practical exercises will be used to aid learning throughout.

Delivery method: Group-Live. NASBA defined level: advanced

CPE Credits - 32

The course provides in-depth coverage:

• Students will learn about the history, operation, and artifacts associated with the Google Chrome and Microsoft Chromium-Edge browsers.
• Students will learn how web pages are constructed and use this information together with Chromium Edge cache content to locate and recover the component parts of a page from a WordPress website and rebuild it.
• Students will learn about the structure and operation of web pages and how to rebuild them.
• Students will learn about the history, operation, and artifacts associated with the Mozilla Firefox browser.
• Students will learn about the operation of web search engines.
• Students will learn the fundamental principles of email operation and how email is sent and received.
• Students will learn how email message data (including attachment data) is encoded and how deleted attachment data may be recovered in certain circumstances.
• Students will learn the history, operation, and artifacts associated with BitTorrent™ file sharing software.
• Students will learn first-hand how the eMule file sharing application operates via publicly available server software that can be configured to run privately and on a non-standard port.
• Students will learn about how the GigaTribe peer-to-peer software allows its users to chat and share files individually and within closed groups.

Course Syllabus

Audience

This course is intended for corporate and government/law enforcement investigators, legal professionals and network security personnel. Incident response supervisors and team members are encouraged to attend as are individuals working in a penetration testing or network intrusion investigation role. An understanding of the concepts of computer forensics and familiarity with the OpenText™ EnCase™ software is required. Class curriculum is designed to provide a good overview of Internet usage investigation issues, both from a forensic and network-security perspective.

Prerequisites

DF210 - Building an Investigation with EnCase or EnCE Certification. Advance preparation for this course is not required.