EnCase DF210 – Building an Investigation with EnCase Forensic

**Formerly EnCase v7 Computer Forensics II**

This course is designed for investigators with concrete computer skills, prior computer forensics training, and experience using EnCase® Forensic. The course builds on the skills aquired in the DF120 – Foundations of Digital Forensics course and enhances the examiner’s ability to work efficiently through the unique features of EnCase. DF210 will build an investigation using analysis techniques, such as recovering volumes, registry analysis, and examining compound files. It then progresses through the analysis of Windows artifacts, shortcut link files, Recycle Bin, stored internet data, and email. The knowledge gained will assist criminal, corporate, and cybersecurity analysts.

Students attending need to have a fundamental understanding EnCase forensic concepts, the structure of the evidence file, creating and using case files, data acquisition and basic analysis methods. Also, it is important that the students are familiar with the methods for recovering deleted files and folders in a FAT environment, conducting indexed queries and keyword searches across logical and physical media, creating and using EnCase® bookmarks, file signature analysis, and exporting evidence.