This course builds on the concepts introduced in CC 101 (BDFI). It covers the architecture and functionality of the Windows NT File System (NTFS), the FAT and the ExFAT File System, and related directory entry information for locating files on electronic devices. Topical areas include file headers and file hashing, recovery of deleted files and long file names, and techniques for discovering potential evidence that might otherwise be overlooked. This course incorporates an investigative scenario, providing hands-on experience with examination of hard drive images.
Click here for more informationDigital Evidence Examination and Processing (DEEP)
Provider: National White Collar Crime Center (NW3C)
Target Audience: Officers
Topic Area: Cyber Forensics, Cyber Investigations
Event Type: Training
Delivery Method: Classroom
