DF202 – Intermediate Digital Forensic Analysis: Windows File System (IDFA-WIN-FS)
This course introduces investigators and digital forensics professionals in law enforcement to the file systems utilized by Microsoft Windows®. The course provides knowledge and skills that will assist students in many facets of their examination of digital evidence located in FAT32, exFAT, and NTFS formatted media. The concepts covered for each of the file systems will include a detailed look into the structure of the file systems and a look into the process that occurs when files or folders are saved, deleted, and restored. Detailed hands-on exercises will give students the knowledge and skills to articulate key findings to investigators, prosecutors, judges, and juries.
Key concepts covered in this course include:
Computer communication and formatting
File system structure and layout
Who Should Attend
This course is intended for law enforcement personnel with experience with acquisition and examination of digital evidence.