ICAC-WinArt Class List

ICAC-Cybercop 315 - Windows Artifacts

This course is funded through OJJDP. To register for this class, you must be affiliated with an ICAC Task Force. Furthermore, you must agree to comply with the Best Practices and Standards established by ICAC. If you have any questions about the ICAC Best Practices and Standards, please contact your ICAC commander.

This 5 day course begins with an introduction to the NT file system and the basic building blocks of the NT file system. Topical areas include metadata files, file attributes, dates and times, and the processes of saving and deleting files as well as recovering them. The students are then introduced to the identification and extraction of artifacts associated with Windows operating systems (XP through Windows 8) and the NT file system. Topical areas include named data streams, reparse points, encrypted objects, and a detailed examination of various registry artifacts to include mounted devices, the user assist key, security components and user specific information. Students will also examine event logs, volume shadow copy service, and thumbnails. The artifacts will be covered in a classroom and interactive setting which includes accessing suspect images in a virtual environment.

PREREQUISITES: This course requires the student have previous training in Cybercop 101 - BDRA and Cybercop 201 - IDRA, or the equivalent and experience drawn from the application of the techniques utilized in these classes.

There is 1 ICAC-WinArt class currently scheduled.

Date Length Location Instructor(s) Registration Addendum
Mon, Sep 22, 2014 4 1/2 Days Santa Clara County Crime Laboratory
250 West Hedding Street
San Jose, CA 95110
Inquire if Needed Request

Back to List

Forensics Tool Testing

National Institute of Standards and Technology

In an effort to enhance its support for law enforcement at the state and local level, NW3C participates in the National Institute for Science and Technology’s Computer Forensics Tool Testing (CFTT) steering committee.

More . . .

Hosting NW3C Classes

If you are interested in hosting NW3C’s training in your area please review the appropriate information below. Note that your agency will be allowed to reserve seats for the class(es) and must meet the criteria described in the document associated with the type of hosting you request.


Training Contacts

Instructor Led
Phone:   (877) 628-7674
Email: training@nw3c.org

Online
Email:     onlinelearning@nw3c.org


NW3C Social Media Channels

© 2012. NW3C, Inc. d/b/a the National White Collar Crime Center. All Rights Reserved.
Disclaimer | Privacy Policy | Sitemap