Learn the science of Cryptography and how it plays a role in computer forensics.

This course provides students with the knowledge and skills necessary to install, configure, and effectively use the combined abilities of AccessData's Forensic Toolkit (FTK) and Password Recovery Toolkit (PRTK) to locate and examine e-mail messages, deleted files, free space and file slack.

This hands-on course is designed for examiners with advanced computer skills and two or more years of experience working in the field of computer forensics. Participants learn to use some of the more advanced features of EnCase® Forensic version 7 (EnCase v7) while examining operating and file system artifacts from the Microsoft® Windows operating systems. The course demonstrates advanced methods of data recovery, and identification and recovery of encrypted data.

Please note that this course is run: On-Demand, therefore no training dates will appear.

*Students must understand evidence handling; the structure of the evidence file; creating and using case files; data acquisition methods including DOS based, hardware write protected, crossover cable and disk to disk; recovering deleted files and folders in a FAT environment; keyword searches across logical and physical media; creating and using EnCase bookmarks; file signatures and signature analysis; and locating and understanding Windows® artifacts.

3-Day instructor led course focused on systematic and efficient examination of computer media using X-Ways Forensics.

Complete and systematic coverage of all computer forensics features in WinHex and X-Ways Forensics. Hands-on exercises, simulating most aspects of the complete computer forensics process. Attendees are encouraged to immediately try newly gained insights as provided by the instructor, with sample image files. Many topics are explained along with their theoretical background (e.g. how .e01 files work internally, how hash databases are internally structured, how deleted partitions are found automatically, with what methods X-Ways Forensics finds deleted files). Other topics are forensically sound disk imaging and cloning, data recovery, search functions, dynamic filtering, report creation, ... Emphasis can be put on any aspect suggested by the participants. You will receive complete printed training material for later repetition. Prerequisite: basic knowledge of computer forensics.

3-Day instructor led course focused on systematic and efficient examination of computer media using X-Ways Forensics.
PLUS
2-Day Instructor led course focused on file systems using X-Ways Forensics.

Extensive introduction to the file systems FAT12, FAT16, FAT32 (1/2 day), NTFS (1 day), and Ext2/Ext3 (1/2 day). By fully understanding the on-disk structures of the file system, you are able to recover data manually in many severe data loss scenarios, where automated recovery software fails, and to verify the correct function of computer forensics software and to collect meta information beyond what is reported automatically, which might yield clues for the given case. In general, this also leads to a better understanding of the data presented by forensic software, of how computer forensics software works and of its limitations.

This one day workshop will familiarise users with the basics of Intella, a product used for email investigation, early case assessment and ediscovery reviews.

This web-based class will enable users to become proficient in the use of Intella®, Vound’s innovative email investigation and eDiscovery tool. Intella’s powerful indexing search engine, its unique visual presentation enables users to quickly, and easily search and review email and electronically stored information to find critical information, visualise relevant relationships, and drill down to the most pertinent evidence.

This course provides students with the knowledge and skills necessary to conduct an effective Internet application based investigation. Students should already be conducting computer based investigations and be familiar with the AccessData suite of tools. Internet based investigations experience would provide additional background knowledge but is not necessary. This is not an undercover investigations course, it is data recovery focused.

This advanced AccessData® training class provides the knowledge and skills necessary to recover and analyze forensic artifacts from the Macintosh operating system using Forensic Toolkit® (FTK®), FTK Imager, and Password Recovery Toolkit® (PRTK®). Participants will learn GPT drive structure and sound methodology for imaging Macintosh hard drives as well as how to obtain date and time information from Macintosh systems. In addition to working with the Macintosh operating system, participants will recover artifacts from Macintosh-associated programs such as Safari and Firefox browsers, iChat, and Apple Mail. Participants will also learn how to recover artifacts from iPod and iPhone devices. 

This advanced AccessData training class provides the knowledge and skills necessary to analyse Microsoft Windows 7 operating system artifacts and file system mechanics using Forensic Toolkit (FTK), FTK Imager, Password Recovery Toolkit (PRTK) and Registry Viewer.

This 3 day course provides students with the knowledge and skills necessary to conduct an effective Windows based investigation. Attendees should already be conducting computer based investigations and be familiar with the AccessData suite of tools.

Students attending this course will learn how to complete a forensic examination of the Apple iPhone, iPod Touch and iPad devices. Participants will learn how to recover stored and deleted data from the devices, such as calls, voicemail, email, SMS, MMS, pictures, web data, documents, maps, GPS information etc.