DF210 - Building an Investigation with EnCase Forensic Training (formerly Encase Computer Forensic II, CF2) is hands-on course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the EnCase® Forensic version 8 (EnCase 8). This course builds upon the skills covered in the EnCase® v8, DF210 course and enhances the examiner's ability to work efficiently through the use of the unique features of EnCase 8. Students must understand evidence handling, the structure of the evidence file, creating and using case files, and data acquisition methods, including DOS-based, hardware write protected, crossover cable, and disk-to-disk. It is also important that the students are familiar with the methods for recovering deleted files and folders in a FAT environment, conducting keyword searches across logical and physical media, creating and using EnCase® bookmarks, file signatures and signature analysis, and locating and understanding Windows® artifacts.
|Prerequisite||DF120 - Foundations in Digital Forensics with Encase Forensic or EnCase® Computer Forensics I.
Advance preparation for this course is not required.
Who Should Attend
This course is intended for IT security professionals, litigation support and forensic investigators. Participants should have attended the DF120 - Foundations in Digital Forensics with Encase Forensic or EnCase® Computer Forensics I.