This course is funded through OJJDP. To register, you must be affiliated with an ICAC Task Force. Furthermore, you must agree to comply with the ICAC Operational and Investigative Standards. Please contact your ICAC task force commander if you have any questions about these standards. Course Description This course introduces investigators and digital forensics professionals in law enforcement to the file systems utilized by Microsoft Windows®. The course provides knowledge and skills that will assist students in many facets of their examination of digital evidence located in FAT32, exFAT, and NTFS formatted media. The concepts covered for each of the file systems will include a detailed look into the structure of the file systems and a look into the process that occurs when files or folders are saved, deleted, and restored. Detailed hands-on exercises will give students the knowledge and skills to articulate key findings to investigators, prosecutors, judges, and juries.
Key concepts covered in this course include: • Computer communication and formatting • File system structure and layout • Saving files • Deleting files • Restoring files
Recommended Skills This course is intended for law enforcement personnel with experience with acquisition and examination of digital evidence. NW3C recommends that students complete the following courses before registering for Intermediate Digital Forensic Analysis: Automated Forensic Tools: Cancellation NW3C may cancel any class for any reason and without notice. NW3C is not responsible for non-refundable travel accommodations lost or rendered moot as a result of a class cancellation. |