Course Overview
    This hands-on course involves practical exercises and real-life simulations. The class focuses on the forensic evidence located on the computer belonging to the suspect and /or victim – not online or cyber investigations. Email files and the Internet are cornerstones of consumer and business computer use. Virtually all computer forensic examinations will involve analysis of email and Internet artifacts, underscoring the need to understand the relevance of Internet and email-based evidence recovered during examinations.
    Delivery method: Group-Live. NASBA defined level: advanced.
    The course will enable students to recover and examine from peer-to-peer file-sharing applications (BitTorrent, Gnutella, etc.), instant messaging applications (Windows® Live Messenger and Yahoo! Instant Messenger) and web browsers (Microsoft Internet Explorer and Mozilla-based browsers). Students will also be able to examine computer systems with regards to Trojan viruses and key loggers. Students will also learn important information with regard to the examination of Outlook PST, web and Lotus Notes email. Students will be able to properly explain the browser caching process and rebuild cached Internet Explorer web pages. The course provides in-depth coverage on artifacts involving:
CPE Credits
    32
Training Level
    Expert
Prerequisite
    EnCase® Computer Forensics II or EnCE® Certification. Advance preparation for this course is not required.
    Note: The content of this course is significantly different and we recommend that anyone who took the EnCase Internet & E-mail course prior to February 2004 now take EnCase Advanced Internet Examinations.
Who Should Attend
  • This course is intended for corporate and government/law enforcement investigators, legal professionals and network security personnel. Incident response supervisors and team members are encouraged to attend as are individuals working in a penetration testing or network intrusion investigation role. An understanding of the concepts of computer forensics and familiarity with the EnCase® Forensic software is required. Class curriculum is designed to provide a good overview of Internet usage investigation issues, both from a forensic and intruder perspective.
Tuition
  • Tuition is $2,495.00 USD per student.
  • See Class Details for Actual Tuition Costs
    Students will learn the history, operation and artifacts associated with peer-to-peer file-sharing applications, such as BitTorrent™ and the Gnutella P2P Network
    Students will learn the impact of Trojan viruses through examination of:
    Defense issues
    The Windows® Registry
    Hash analysis
    Anti-virus scanning and virus analysis using the EnCase® Virtual File System (VFS) Module and the EnCase® Physical Disk Emulator (PDE) Module
    Students will learn about Autostart examinations
    Students will learn how to identify artifacts from instant message clients, such as Windows® Live Messenger and Yahoo!® Messenger
    Students will learn the operation of the Microsoft® Internet Explorer web browser with regards to typed URLs, password and form-data storage, cookies, Internet history and cache content
    Students will learn how web pages are constructed and will use this information, together with their new-found knowledge of cached Internet Explorer web content, to correctly rebuild web pages
    Students will learn about artifacts introduced with Microsoft® Internet Explorer 7
    Students will learn about the history, operation and artifacts associated with Mozilla Firefox®
    Students will learn about the operation of web search engines
    Students will learn about web-based email
    Students will learn about the Microsoft® Outlook PST structure and about viewing Lotus® Notes email data
Syllabus


SELECT LOCATION  SELECT DATE COURSE INFORMATION

DIRECTIONS
For more information regarding refund concerns and program cancellation policies, contact Guidance Software Training at training@guidancesoftware.com or call 626.229.9191 ext. 566.