This training is intended for U.S. Criminal Justice
Practitioners. Please register using your agency-issued email.
This course course introduces investigators and digital
forensics professionals in law enforcement to the file systems utilized by
Microsoft Windows®. The course provides knowledge and skills that will assist
students in many facets of their examination of digital evidence located in
FAT32, exFAT, and NTFS formatted media. The concepts covered for each of the
file systems will include a detailed look into the structure of the file systems
and a look into the process that occurs when files or folders are saved,
deleted, and restored. Detailed hands-on exercises will give
students the knowledge and skills to articulate key
findings to investigators, prosecutors, judges, and juries.
Key concepts covered in this course include:
communication and formatting
• File system
• Saving files
• Restoring files
This course is intended for law
enforcement personnel with experience with acquisition and examination of
NW3C recommends that students complete the following courses before
registering for Intermediate Digital Forensic Analysis: Automated Forensic
All classes are subject to
cancellation up to 45 days before the start of class if the minimum class
registration threshold is not met.
a BYOD (bring your own device) course. You will use
your own laptop computer for all in-class exercises.
The hands-on practical exercises are intensive,
critical to understanding the material being taught, and required to
successfully complete the class. If your computer hardware does not meet the
mandatory requirements listed below, your experience in taking the class will be
less than ideal and may also impact other students while the instructors take
time to troubleshoot hardware and software problems.
Mandatory Operating System
•Operating system.Your computer
must be running Microsoft Windows 10 or macOS v10.12 or later. Make sure your
operating system is fully updated prior to class.
tablets are prohibited.
• Local administrator access is required.
If you do not have administrative rights, you will not be able to
successfully complete the class. Prior to class, please check with your IT
department to install the required software.
• Disconnect your VPN .
Disconnect your work virtual private network (VPN). Being connected to the
Internet through a VPN can block access to the virtual lab
Workspace App. Required to access
our virtual lab environment and to complete the required hands-on practical
• Google Chrome. The recommended browser to
launch our virtual lab environment.
Meetings. Required to enter our live online training
environment, Webex Training Center.
• Webex Chrome Extension. Required to launch our
live online training environment, Webex Training Center, and works hand-in-hand
with the Webex Meetings application.
*Your attendance at this course is conditional upon your
compliance with CDC, state, and local guidance regarding COVID-19 prevention.
While CDC, state, and local guidance is designed to reduce the rate of COVID-19
infections, nothing can eliminate your risk of contracting COVID-19 or one of
its variants. By attending this class, you acknowledge that you understand and
are assuming the risk of contracting COVID-19. Due to the rapidly changing
nature of COVID-19 guidance, infection rates, and safety standards, this class
may be rescheduled or cancelled on short