DF101 Basic Digital Forensic Analysis: Windows Acquisition (May 3–5, 2021, Virtual)

This course provides the fundamental knowledge and skills required to acquire forensic backup images from Windows-based computers and removable storage media in a forensically sound manner.

Presentations and hands-on practical exercises cover the following topics:

• Storage media and how data is stored.
• The forensic acquisition process.
• Tool validation.
• Hardware and software write blockers.
• Forensic backup image formats.
• Multiple forensic acquisition methods. 

Students will use free and commercial third-party tools that are currently used by practitioners in the field.