IR250 - Incident Investigation OnDemand

Home
/
Training
/
IR250 – Incident Investigation OnDemand

IR250 - Incident Investigation OnDemand

Course duration: 32 Hours

CPE Credits: 0

Delivery method: Group-Live

Prerequisites: DF120–Foundations in Digital Forensics with EnCase

Full List of Courses Available

Course Overview

This EnCase Training OnDemand course focuses on the use of OpenText™ EnCase™ Endpoint Investigator (EnCase) and other tools to acquire and analyze data in a manner that demonstrates the relevance of various file system, network, and memory-based artifacts in the context of an investigative scenario. Students will examine the different factors that affect incident investigations, including planning, basic forensic principles, and examination and response options.

They will observe how failing to take note of important issues and implement suitable policies can lead to weaknesses in IT infrastructure and the loss of evidential data. Conversely students will learn to appreciate the benefits of forward planning, employee education, audit and event logging, and suitable access-control policies.

This course is very much focused on the recovery of data for the purposes of an investigation and the context in which said data may prove valuable. Students will participate in practical exercises throughout the course to underscore and drive home the skills taught.

Students attending this course will learn the following:

Incident investigation/response considerations
How to capture disk and memory data using EnCase Endpoint Investigator and other tools
The significance of Windows Registry and file-system metadata, paying particular attention to the NT file system (NTFS) and timestamp analysis
How to identify and recover data encrypted using the Microsoft® Encrypting File System (EFS) and BitLocker®; also how properly applied group policies can help to recover said data and the potential significance of NTFS alternate data streams
The benefits of USN change log and ShellBag analysis and how they may complement one another
The significance and analysis of shortcut link files and jumplists
Windows event log and $LogFile analysis
Microsoft Windows® Recycle Bin mechanics and analysis
Examination of volume shadow copies
Memory analysis using Volatility; also the recovery of passwords, encryption keys, and other data from memory dumps
Determining the nature, identity, and provenance of files and folders using hash, signature, and USN change log analysis
Identification and recovery of artifacts from Internet Explorer, Edge, Firefox, and Chrome

Please note that this course touches on subjects covered by other EnCase Training courses, so attendees of those courses may experience a small overlap.

Audience

This entry-level course is intended for digital forensic investigators, including IT specialists, security analysts, DFIR practitioners, and traditional digital investigators. Participants should have Foundations level EnCase skills.

Learn more about our training courses

We are excited about your interest in our courses and eager to provide you with all the details you need.

Send us a message via the contact form and we will get back to you as soon as possible.

Send us your enquiries

CYBER SECURITY EXPERTS IN ASIA-PACIFIC

Founded in 2010 by a group of industry experts, we work tirelessly to provide security solutions that protects individual and organizations from cyber-attacks.