This course is funded through OJJDP. To register, you must be affiliated with an ICAC Task Force. Furthermore, you must agree to comply with the ICAC Operational and Investigative Standards. Please contact your ICAC task force commander if you have any questions about these standards.

Course Description
This course introduces investigators and digital forensics professionals in law enforcement to the file systems utilized by Microsoft Windows®. The course provides knowledge and skills that will assist students in many facets of their examination of digital evidence located in FAT32, exFAT, and NTFS formatted media. The concepts covered for each of the file systems will include a detailed look into the structure of the file systems and a look into the process that occurs when files or folders are saved, deleted, and restored. Detailed hands-on exercises will give students the knowledge and skills to articulate key findings to investigators, prosecutors, judges, and juries.

Key concepts covered in this course include:
     • Computer communication and formatting
     • File system structure and layout
     • Saving files
     • Deleting files
     • Restoring files

Recommended Skills
This course is intended for law enforcement personnel with experience with acquisition and examination of digital evidence.

NW3C recommends that students complete the following courses before registering for Intermediate Digital Forensic Analysis: Automated Forensic Tools:

• Introduction to Previewing (online course)
• Encryption (online course)
• Basic Digital Forensic Analysis: Seizure (classroom or live online course)
• Basic Digital Forensic Analysis: Windows Acquisition (classroom or live online course)

Cancellation
NW3C may cancel any class for any reason and without notice. NW3C is not responsible for non-refundable travel accommodations lost or rendered moot as a result of a class cancellation.

Computer Requirements
The hands-on practical exercises are intensive, critical to understanding the material being taught, and required to successfully complete the class. If your computer hardware does not meet the mandatory requirements listed below, your experience in taking the class will be less than ideal and may also impact other students while the instructors take time to troubleshoot hardware and software problems.

Mandatory Operating System Requirements
• Operating system.Your computer must be running Microsoft Windows 10 or macOS v10.12 or later. Make sure your operating system is fully updated prior to class.
• Smartphones and tablets are prohibited.
• Local administrator access is required. If you do not have administrative rights, you will not be able to successfully complete the class. Prior to class, please check with your IT department to install the required software.
• Disconnect your VPN. Disconnect your work virtual private network (VPN). Being connected to the Internet through a VPN can block access to the virtual lab environment.

Mandatory Software Requirements
• Citrix Workspace App. Required to access our virtual lab environment and to complete the required hands-on practical exercises.
• Google Chrome. The recommended browser to launch our virtual lab environment.
• Webex Meetings. Required to enter our live online training environment, Webex Training Center.
• Webex Chrome Extension. Required to launch our live online training environment, Webex Training Center, and works hand-in-hand with the Webex Meetings application.