)
)
)
Internet-based Investigations with EnCase
May 30 – June 2 (Pre-Conference)
This advanced-level, hands-on course focuses on the forensic examination of application data critical to Internet-based investigations. Participants will learn specialized techniques for recovering and analyzing evidence from web browsers, search engines, email clients, and peer-to-peer software. The course also provides in-depth training on examining SQLite databases, including methods for recovering deleted SQLite data. Practical exercises will be used to aid learning throughout.
Delivery method: Group-Live. NASBA defined level: advanced
CPE Credits - 32
The course provides in-depth coverage on the following:
- Students will learn about the aspects of SQLite that will be most relevant to a forensic investigator, including using SQL to query SQLite data.
- Students will learn about the structure of SQLite database files and how and why deleted data may be recoverable.
- Students will learn about the history, operation, and artifacts associated with the Google Chrome and Microsoft Chromium-Edge browsers.
- Students will learn about the importance abs structure of the Google Chrome Cache, including the parsing of sparse cached data
- Students will learn about Google Chrome LevelDB and IndexedDB
- Students will learn about the history, operation, and artifacts associated with the Mozilla Firefox browser.
- Students will learn about the operation of web search engines.
- Students will learn the fundamental principles of email operation and how email is sent and received.
- Students will learn how email message data (including attachment data) is encoded and how deleted attachment data may be recovered in certain circumstances.
- Students will learn the history, operation, and artifacts associated with BitTorrent™ file sharing software.
- Students will learn first-hand how the eMule file sharing application operates via publicly available server software that can be configured to run privately and on a non-standard port.
Please add the code TECHNOEA25 in the comments field during the registration process. Please also note that the class description on the registration page differs slightly from what will be delivered. SQLite will be included and Gigatribe will be provided as information only in the training materials.
