Training Course:EnCase v6 NTFS (Certificate)School/Trainer:Dimension Data Learning Solutions
Adelaide, Brisbane, Canberra, Melbourne, Perth, Syndey, Australia
Course Format: Classroom | E-learning | Virtual Class | Online | On-site | Blended | Self-paced
Course Description:
'' This hands-on course involves practical exercises and technical information about the NTFS file system. The class addresses the technical issues of the NTFS file system, including an in-depth analysis of the Master File Table (MFT) and its components. Students will locate and recover NTFS artifacts from the MFT and understand their evidentiary value. The course will delve into the NT Registry files for data identifying the computer user, installed applications and customised configurations. Students will recover encrypted passwords, identify alternate data streams, reparse points and mapped drives, identify security permissions for users and determine if removable media was connected to a NTFS volume. In addition, students will examine partially wiped drives and recover files from partially wiped NTFS volumes.
Emphasis is placed on the meaning and relevance of the artifacts that administratively document the NTFS file system.
Skills Gained: Components of the NTFS Volume Boot Record and the Master File Table
Definitions and purpose of NTFS internal system files
Characteristics and storage of NTFS resident and non-resident attributes
Storage of alternate data streams and reparse points
Addressing NTFS user account information, encryption and file system security
Parsing and examining the NTFS registry
Linking media to an NTFS volume
Addressing technical issues associated with NTFS file systems
Advanced NTFS data recovery
Key Topics: The day begins with a review and update of the most current version of EnCase, as well as an introduction to the NTFS data structures. Students are introduced to the methods used to store binary data on a computer system, and use this information to interpret multi-byte values throughout the week.
- EnCase Software Review and Updates
- Research Techniques
- NTFS Structures
- NTFS Metadata files
- Master File Table
Day two continues with the discussion of the MFT by covering the Standard Information, Filename, Volume and Data Attributes.
- MFT Attributes; Definitions/Components
- Resident and Non-Resident Data
- Alternate Data Streams
- NTFS $LOGFILE
Day three begins with a practical exercise involving a partially wiped drive. The directory information is absent, but the MFT exists in unallocated space. Students must identify records referencing certain filenames and recover the files.
- Recovering files from partially wiped NTFS volume using the MFT
- Encryption
- Reparse Points
- NTFS Folder Information - Index Roots, Entries and Index Buffers
- NTFS File System Security
Day four exposes participants to NTFS registry examinations. Students will identify methods of performing registry examinations, using manual methods and EnScripts.
- Handling NTFS Registry Examinations
- Registry Data
- Link files
- Final Practical Exercise
...''
Elements of this syllabus are subject to change.
Please go to the school's official website for training price and schedule:
http://www.ddls.com.au/
Phone:13 12 01 / 08 8236 8200
School Address:
Level 7
553 Hay St
Perth WA 6000
Level 4, PKF House
139 Frome St
Adelaide 5000
Level 10, Thakral House
301 George St
Sydney 2000
Level 3, Dimension Data Building
11-17 Dorcas St
South Melbourne 3205
Level 12
307 Queen St
Brisbane 4000
Jobs & Resumes: Adelaide, Brisbane, Canberra, Melbourne, Perth, Syndey
Houses & Roommates: Adelaide, Brisbane, Canberra, Melbourne, Perth, Syndey
Travel Agencies: Brisbane, Melbourne, Perth,
Search other schools for EnCase v6 NTFS training resources.
Other training courses offered by Dimension Data Learning Solutions:
Interconnecting Cisco Networking Devices (v1.0) ICND1
Citrix XenApp 4.5 and 5.0 for Windows Server 2003: Administration
Implementing Citrix XenApp 5.0 for Windows Server 2008
Citrix Access Gateway 4.5 Advanced Edition: Administration
Citrix Password Manager 4.5: Administration
Citrix XenApp (Presentation Server 4.5): Support
Citrix Access Suite 4.0: Build/Test Workshop
CompTIA A+ Certification Essentials Support Skills
CompTIA A+ Certification Electives
Practical Digital Evidence Gathering
EnCase v6 Network Intrusion Investigations
EnCase v6 Advanced Internet Examinations
EnCase v6 Advanced Computer Forensics
EnCase v6 Computer Forensics II
EnCase v6 Computer Forensics I
EnCase v6 FIM/Mobile Use of EE Live Forensics
D8750/760/770 IBM Lotus Domino R8 - System Administrator
D8720 Exploring New Features in IBM Lotus Domino 8 Administration
Notice: The course description on this page was captured from the Internet as historical reference or submitted by visitors. It was archived statically and not updated from day to day.
Tips:
Besides Acquiring latest course information by the search form, Students can also leave their study interests here and let schools callback. |
|
|
