Windows Forensic - XP

Course Description

This course provides students with the knowledge and skills necessary to conduct an effective Windows based investigation. Attendees should already be conducting computer based investigations and be familiar with the AccessData suite of tools.

In addition to using advanced search and filtering techniques, students will use the Ultimate Toolkit (with the new Registry Viewer) to address the following Windows artifacts:
o The Recycled / Recycler Bin --- (deleted files, place-holders and INFO2 databases)
o File Meta Data and OLE Items --- (dates and times and file summary data)
o Print Spools and Remnants --- (print jobs and temp files that remain behind)
o Unallocated Data Carving --- (recovering files from unallocated and embedded space)
o Windows Log & Link Files --- (other system device access / login records)

Registry File Data - Using the new Registry Viewer - specifically:
o NTUSER.DAT / SYSTEM files --- (protected storage data / user info)
o SAM / SOFTWARE / SECURITY / SYSTEM --- (machine time bias / USER-SID / login)

Students will also learn how to gain access to files that have been encrypted with the Microsoft Encrypted File System (EFS) component, parse thumbnail lists from Windows and other popular applications, and more.

This advanced level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and security and network administrators who desire a greater understanding of the Windows registry and other various operating system artifacts as they relate to computer forensic investigations.

The Windows Forensics course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.

Contact: Jessica Parry 801- 377-5410 X856

Windows Forensic Registry

Course Description

In the continually evolving Windows Forensics series, the Windows registry continues to be a major source of Windows related artifact and information storage. Having the proper knowledge of registry based artifacts can make or break an investigation. In this course, attendees will utilize AccessData technology while being exposed to:

• Registry hive, cell and “hbin” block construction
• Live registry file capture from a Windows environment
• Carving registry key information from dumped memory files
• Registry testing, analysis and reporting technology
• Registry back-ups (system Volume Information and Restore Points)
• Tracking Trojan Horse programs through a suspect registry
• Tracking file associations and class ID information
• Analyzing mounted device association (USB and other devices)
• Discovering machine compromise through registry infiltration

Contact: Jessica Parry 801- 377-5410 X856

NLECTC-NW
Training Center
6411 A Street, Anchorage, AK

Intro to ALEISS (COPLINK)       APSC Certified Training
*Must be eligible ALEISS User to attend.

Contact: Maxine Andrews 907-569-5685

No cost

LInX "Train the Trainer"        APSC Certified Training
*Must be eligible ALEISS User to attend.

Contact: Maxine Andrews 907-569-5685

No cost

Intro to ALEISS (COPLINK)       APSC Certified Training
*Must be eligible ALEISS User to attend.

Contact: Maxine Andrews 907-569-5685

No cost

Cell Phone Forensics
direct link to registration page

Three day, hands-on cell phone forensic training which includes hardware, software and a comprehensive student manual. Over $1,000 in equipment is included to students offering a solid foundation to examiners.

Contact: Bill Jeitner 215 825-7419

*$250 APOA member
*$300 non-member

*Registration is for entire conference.

          
ALEISS (COPLINK) &LInX

Contact: Maxine Andrews 907-569-5685

*$250 APOA member
*$300 non-member

*Registration is for entire conference.

Alaska Law Enforcement Information Sharing System (ALEISS)
User Group and COPLINK Training
pre-registration required. User Group meeting and lunch can be attended without attending training please RSVP for lunch.

Contact: Maxine Andrews 907-569-5685 class is full

Western States Information Network (WSIN)

Hands on training for access and utilization of the WSIN/RISS nationwide database.There will be four sessions, each four hours in length offered to current members of WSIN. Choose Thursday, Sept. 4th, 8 am to noon or 1 pm to 5 or Friday, Sept. 5th, 8 am to noon or 1 pm to 5.We only have room for 15 students per session so book early as this is first come, first served. There is no fee for the class.  Contact Skip Coile at 245-4595 or via email at: if you have questions or want to register.

Windows Forensic - XP

Course Description

This course provides students with the knowledge and skills necessary to conduct an effective Windows based investigation. Attendees should already be conducting computer based investigations and be familiar with the AccessData suite of tools.

In addition to using advanced search and filtering techniques, students will use the Ultimate Toolkit (with the new Registry Viewer) to address the following Windows artifacts:
o The Recycled / Recycler Bin --- (deleted files, place-holders and INFO2 databases)
o File Meta Data and OLE Items --- (dates and times and file summary data)
o Print Spools and Remnants --- (print jobs and temp files that remain behind)
o Unallocated Data Carving --- (recovering files from unallocated and embedded space)
o Windows Log & Link Files --- (other system device access / login records)

Registry File Data - Using the new Registry Viewer - specifically:
o NTUSER.DAT / SYSTEM files --- (protected storage data / user info)
o SAM / SOFTWARE / SECURITY / SYSTEM --- (machine time bias / USER-SID / login)

Students will also learn how to gain access to files that have been encrypted with the Microsoft Encrypted File System (EFS) component, parse thumbnail lists from Windows and other popular applications, and more.

This advanced level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and security and network administrators who desire a greater understanding of the Windows registry and other various operating system artifacts as they relate to computer forensic investigations.

The Windows Forensics course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.

Contact: Jessica Parry 801- 377-5410 X856

ACE Certification

Description

The ACE Certification Day is the culmination of the ACE process, and exists to allow candidates to demonstrate their skills, knowledge and abilities with AccessData imaging and analysis technology in a one stop event. The Certification Day consists of two portions:
1) The Knowledge Based Assessment (KBA)
2) The Practical Based Assessment (PBA)

During the KBA, candidates are provided 90 minutes to answer 60 questions via an online, web-based testing interface.

During the PBA, candidates are timed in multiple task based technology sessions with defined data sets and defined goals. These tasks are not evidence or crime based.

All testing is "closed-book", meaning no external media, books, personal computers, etc … are permitted.

The Certification Day is proctored by an ACE certified, AccessData instructor.

Contact: Jessica Parry 801- 377-5410 X856

NLECTC-NW
Training Center
6411 A Street, Anchorage, AK