The class provides participants with an understanding of how EnCase™ may be used to examine data related to incident response, and employee misconduct investigation, and/or a law enforcement criminal and/or civil investigation.
Participants create cases using EnCase™, configure the application to maximize its utilization, and learn evidence acquisition concepts and how to validate the data collected. Instruction progresses to the analysis of the data whether related to a criminal investigation, cyber-security incidents or other matters.
The course will cover techniques such as keyword or indexed searching along with hash analysis reports relating to examination findings. The course concludes with instructions or archiving, validating the data and restoring the case.