Courses by Description

This 4 day course is designed to be an introduction to the architecture and functionality of the Windows NT File System (NTFS) and the processing issues related to it. Topical areas include a detailed look at named data streams, reparse points, previous versions, the encrypting file system (EFS), and BitLocker. Processing issues such as recovering deleted files, recovering information from the recycle bin, and methods for gaining operating system and file system access are also addressed.

Prerequisites: Cybercop 101 (BDRA) and Cybercop 201 (IDRA) or the equivalent, with in-field/lab experience.