CPE credits: 32   |  Level: Advanced   |  Prerequisites: EnCase Enterprise - Phase I or the five day implementation training conducted by Guidance's Professional Services Division. This course is designed for senior corporate security professionals, auditors, legal professionals, and investigators. Students should currently be working with the EnCase Enterprise Edition or are employed by an organization that plans to purchase the EnCase Enterprise Edition. Advance preparation is not required.

This intermediate level hands-on course focuses on the administration and advanced use of EnCase Enterprise. Students will learn how to use the EnCase Enterprise in a live network environment to address internal investigations, electronic discovery, as well as the integration of EnCase Enterprise with intrusion detection systems. Delivery method: Group-Live. NASBA defined level: advanced.

This course involves extensive use of the EnCase Enterprise, including coverage of administration of the SAFE, and the automation of the eDiscovery process. Students will also gain an understanding of how the EnCase Enterprise integrates with intrusion detection systems to create a real-time incident response and investigative environment. Forensic analysis of common artifacts from Windows® and Linux environments is included to provide a well rounded skill set to the experienced investigator.

The following are some of the topics covered during the four-day Enterprise - Phase II course:

• Students will learn how data flows in the EnCase Enterprise environment. The built-in security features of the product will also be discussed.
• Students will learn about the administration of the SAFE, including the management of network nodes (clients) and Enterprise roles and users.
• Students will learn how Snapshot and the capture of volatile data can be used to gain a more complete picture of the status of a machine or machines during an incident investigation.
• Students will learn how using Snapshot with Application Descriptors and Machine Profiles can streamline incident investigations, quickly identifying potentially rogue applications on the network.
• Students will learn how to file and process remediation once the source of an incident has been identified.
• Students will optimize network acquisitions in EnCase Enterprise version 6.
• Students will learn to understand file ownership in an Enterprise environment.
• Students will use the EnCase Decryption Suite to address encrypted data.
• Students will identify and recover Windows/Linux artifacts from live machines over the corporate infrastructure.
• Students will use the EnCase Virtual File System in real world examinations.
• Using and designing filters and queries to streamline investigations of all kinds.
• Students will use the EnCase Enterprise with intrusion detection systems to identify and capture vital data in an automated and real time environment.
• Students will learn to automate the eDiscovery process using EnCase Enterprise. Students will understand how EnCase Enterprise can rapidly identify and retain data across the network using a set of criteria provided by the examiner.

---

Tuition is $3,750.00 per student
Government training rate is $2,498.00 per student