DF202 Intermediate Digital Forensic Analysis: Windows File Systems

This course provides students with the fundamental knowledge and skills necessary to perform a limited digital forensic examination, validate hardware and software tools, and effectively use digital forensic suites and specialized tools. The course begins with a detailed study of the digital forensic examination process, including documentation, case management, evidence handling, validation, and virtualization. Students learn to use todays leading commercial and open source digital forensic suites: Magnet Axiom, X-ways Forensic, and Autopsy. Instruction on each suite will include an interface overview, configuration, hashing, file signature analysis, keyword searching, data carving, bookmarking, and report creation. *Digital forensic process. Evidence review; requests for examination; case management. *Validation. Creation of validation images; validation testing. *Effective tool usage. Tool interface; hashing; file signature analysis; data carving; searching; metadata; bookmarking. *Reporting. General report structure; report templates; using tool-generated reports.