EnCase Enterprise Phase I / Implementation



			Go to Digital Investigations courses.


EnCase Enterprise Phase I / Implementation
Vendor Course Code:
Course Length:	4 days
Course Price:	$3,700.00 plus $370.00 GST = $4,070.00 inc. GST
Availability:	Please call DDLS on 1800 U LEARN (1800 853 276) or click here to register your interest.
Overview:	This basis hands-on course focuses on the use of EnCase Enterprise to conduct investigations in a live network environment. Students will learn how to use EnCase Enterprise to address internal investigations and audits in a manner consistent with recognized standards. The class makes extensive use of the Encase Enterprise to emphasize the common skills needed to conduct forensic examinations. Many of the skills taught in this course are consistent with the forensic intermediate course but have been adapted to the network forensic environment.
Skills Gained:	The following topics and skills will be covered in this course: * Students will learn to install the EnCase SAFE and understand how data is secured in the EE environment * Students will learn how to deploy servlets to supported operating systems (WindowsŽ, nix, Mac) Students will learn Enterprise-wide vs. "Ad-Hoc" servlet deployment methods and benefits * Student will gain an understanding of the EnCase evidence file and examination methodology * Students will acquire evidence using the EnCase Enterprise and non-enterprised acquisitions * Students will learn to understand the role of volatile data on network investigations and security * Students will use EnCase SnapshotŽ to capture and analyze enterprise wide volatile data * Students will learn to bookmark files and file segments * Students will create keywords and learn how to use them to search in an enterprise environment * Students will identify files using hash values and building hash libraries * Students will identify Windows XP operating system artifacts such as registry entries, link files, recycle bin, and user folders * Students will learn how to prepare evidence for presentation in court * Students will learn to recognize and validate file signatures * Students will recover deleted partitions * Students will recover NTFS file system artifacts such as swap files, file slack, and spooler files * Students will recover printed pages
Key Topics:	Day One * How the EnCase evidence file is stored and verified * Enterprise Edition overview * Creating a case * Proper handling and logging of evidence * Enterprise Previews * Hardware Write Protection * DOS-based acquisitions Day Two * Basic Views * Basic Keyword Searches * Hash Analysis * Signature Analysis * Viewing and Exporting Files Day Three * Using GREP to "fine tune" search results * Recovering and analyzing email attachments * Internet History concepts and analysis using Internet Explorer Day Four * Quickly locating file system artifacts unique to the NTFS File System * Understanding and recovering documents that have been printed * De-constructing link files to reveal artifacts that indicate who, what, when and where of file manipulation * Recycle bin analysis to reveal important information about deleted files * Restoring the evidence file to working media, to be used in further "live" examination or to provide a verified copy to opposing council * Using bookmarks made during previous training to prepare a written report within the EnCase interface, and exporting this report to an HTML or other format
Target Audience:	This course is designed for senior corporate security professionals, auditors, legal professionals, and investigators. Students should currently be working with the EnCase Enterprise Edition or are employed by an organization that plans to purchase the EnCase Enterprise Edition.
Prerequisites:	None