Cybercop 201 - Intermediate Data Recovery and Analysis - IDRA

The "Cybercop (CC) 201 - Intermediate Data Recovery and Analysis" (IDRA) course builds on the concepts introduced in "CC 101 - Basic Data Recovery and Acquisition" (BDRA). This course covers the architecture and functionality of the Windows NT File System (NTFS), the FAT File System, and related directory entry information for locating files on electronic devices. Topical areas include file headers and file hashing, recovery of deleted files and long file names, and techniques for discovering potential evidence that might otherwise be overlooked. This course incorporates an investigative scenario, providing hands-on experience with hard drive examination.

Course Structure:

• Understand Architecture and functionality. Learn about NT and FAT file systems as well as directory entry information.
• Identify evidentiary files. Understand signature analysis of file headers and file hashing, as well as MD5 and SHA1 hashing algorithms.
• Recover deleted files. Learn to recover files from the recycle bin, as well as deleted files no longer located in the recycle bin.
• Learn search techniques and virtual memory. Locate valuable information within virtual memory, unallocated space, slack space, and application metadata. Learn to perform keywords, ASCII, and UNICODE searches.
• Develop hands-on experience. Examine four different “suspect” hard drives.

IDRA is a three-and-a-half-day classroom course.

Prerequisite:

• CC 101 – BDRA classroom course.
• Equivalent training and/or experience may substitute for the prerequisite.