Courses by Description

This course is funded through OJJDP. To register for this class, you must be affiliated with an ICAC Task Force. Furthermore, you must agree to comply with the Best Practices and Standards established by ICAC. If you have any questions about the ICAC Best Practices and Standards, please contact your ICAC commander.

This 4 day course is designed to be an introduction to the architecture and functionality of the Windows NT File System (NTFS) and the processing issues related to it. Topical areas include a detailed look at named data streams, reparse points, previous versions, the encrypting file system (EFS), and BitLocker. Processing issues such as recovering deleted files, recovering information from the recycle bin, and methods for gaining operating system and file system access are also addressed.

Prerequisites: Cybercop 101 (BDRA) and Cybercop 201 (IDRA) or the equivalent, with in-field/lab experience.