CC 201 - Digital Evidence Examination and Processing (Nov 2018, California)

Tuesday Nov 27, 2018 - 01:00pm UTC to Friday Nov 30, 2018 - 10:00pm UTC
Event Description: 

This course builds on the concepts introduced in "Cybercop 101 - Basic Digital Forensic Imaging." It covers the architecture and functionality of the Windows NT File System (NTFS), the FAT and the ExFAT File System, and related directory entry information for locating files on electronic devices. Topical areas include file headers and file hashing, recovery of deleted files and long file names, and techniques for discovering potential evidence that might otherwise be overlooked. This course incorporates an investigative scenario, providing hands-on experience with examination of hard drive images.

Course structure:

  • Architecture and functionality. Learn about NT, FAT, and ExFAT file systems, as well as directory entry information.
  • Evidentiary files. Understand signature analysis of file headers and file hashing, as well as MD5 and SHA1 hashing algorithms.
  • Deleted files. Learn to recover files from the recycle bin, as well as deleted files no longer located in the recycle bin.
  • Search techniques and virtual memory. Locate valuable information within RAM, virtual memory, unallocated space, slack space, and application metadata. Learn to perform keywords, ASCII, and UNICODE searches.
  • Hands-on experience. Examine four different "suspect" hard drive images.
250 West Hedding street
San Jose, CA 95110
United States
Event Cost Information
Space Available: 
Organizer Information
Event POC: 
Damita Jones
Event POC Email: 
Event POC Phone: