+

Three Day Course OverviewClass schedule

Level: Intermediate to Advanced

Prerequisites: Student should have a solid level of understanding with Win98SE/2K/XP. Intermediate understanding of different data structures related to C/C++.

This is a fast paced, hands-on course designed to teach the student how to get the most of our DataLifter Computer Forensic Support Tools. Our most popular tools are described to extreme detail, unmasking the "blackbox" steps used to recover digital data. All students will receive a 278 page combined product manual, 170 page color student workbook, a student CD with secure PDF's of all training material and all of our software[optional].

Day 1

* Using Recycle Bin History Module
* Decoding Link files
* Decoding both 280 byte and 800 byte INFO2 files
* Recovering Link files and INFO2 records from unallocated space with DataLifter
* Decoding MSIE History data
* Decoding MSIE Cache data
* Decoding MSIE Date-Ranged History data
* Basic anatomy of a DBX file
* Recover email from unallocated space with DataLifter
* Theory for manual base64 recovery
* Extract MIME data from unallocated space with DataLifter
* Anatomy of Norton Protected Recycle Bin
* Using Image Linker

Day 2

* Using Parse with Regular Expressions
* Understanding the user interface of File Extractor Pro
* Using the File Signature Editor
* Creating new signatures with File Signature Builder
* Creating Advanced files signatures
* Theory of Artifact Finder
* Using Artifact Finder
* Carving Web based emails

Click here to enrol