CPE credits: 32   |  Level: Expert   |  Prerequisites: EnCase Computer Forensics II or EnCE Certification. Advance preparation for this course is not required.

This hands-on course involves practical exercises and technical information about the NTFS file system. The class addresses the technical issues of the NTFS file system, including an in-depth analysis of the Master File Table (MFT) and its components. Students will locate and recover NTFS artifacts from the MFT and understand their evidentiary value. The course will delve into the NT Registry files for data identifying the computer user, installed applications and customized configurations. Students will recover encrypted passwords, identify alternate data streams, reparse points and mapped drives, identify security permissions for users, and determine if removable media was connected to a NTFS volume. In addition, students will examine partially wiped drives and recover files from partially wiped NTFS volumes. Delivery method: Group-Live. NASBA defined level: advanced.

Emphasis is placed on the meaning and relevance of the artifacts that administratively document the NTFS file system. The course provides in-depth coverage on artifacts involving:

• Components of the NTFS Volume Boot Record and the Master File Table
• Definitions and purpose of NTFS internal system files
• Characteristics and storage of NTFS resident and non-resident attributes
• Storage of alternate data streams and reparse points
• Addressing NTFS user account information, encryption and file system security
• Parsing and examining the NTFS registry
• Linking media to an NTFS volume
• Addressing technical issues associated with NTFS file systems
• Advanced NTFS data recovery

WHO SHOULD ATTEND

This course is intended for law enforcement officers, computer forensic examiners, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics and Internet-related access is required. The class curriculum builds upon the foundation of the EnCase Intermediate Analysis and Reporting courses, continuing with a focus on NTFS file system examinations.

Course Syllabus

---

Tuition is $2,995.00 per student for each class
Government training rate is $1,995.00 per student for each class