Computer forensics is a fairly substantial area, and for this reason the courses are normally separated in to 2 parts, ENCE I and ENCE II, here we will discuss both of the courses, how you will benefit and what you can expect to learn and gain experience in through taking the training.

Through some hands on exercises, real life simulations and text book work you will gain knowledge and confidence in the following areas which you can then take back to your workplace or use your knowledge towards a new career in computer forensics;

    * What constitutes digital evidence and how computers work
    * An overview of the EnCase Computer Forensic Methodology
    * Basic structures of the FAT and NTFS file systems
    * How to create a case and how to preview/acquire media
    * How to conduct basic keyword searches
    * How to analyze file signatures and view files
    * How to restore evidence
    * How to archive files and data created through the analysis process
    * How to prepare evidence for presentation in court
    * How to verify the evidence file

The above topics will give you the base knowledge in computer forensics and upon completion of this course you may find you want to enhance your new found talent and take the eNXCE II course also. The ENCE I is ideal for security professionals and litigation staff that are new in their field or wish to expand their knowledge, you will learn proper handling of computer evidence and then through all the stages to analysis, and finally how to properly archive data so it may be stored and retrieved as required.

Once you have gained the skills from ENCE I moving on to ENCE II you will learn;

    * How to create and use of logical evidence files
    * How to locate and recover deleted partitions and folders
    * How to conduct keyword searches and advanced searches using GREP
    * Students will gain an understanding of the EnCase Virtual File System (VFS) and Physical Disk Emulator (PDE)
    * Students will learn about the Windows® Registry
    * Students will learn how to deal with compound file types
    * How to export files, directories and entire volumes
    * How to identify files using hash values and building hash libraries
    * How to identify Windows XP operating system artifacts such as link files, recycle bin, and user folders
    * How to prepare reports and evidence for presentation in court
    * How to recover artifacts such as swap files, file slack, and spooler files
    * How to recover printed and faxed pages

As you see the ENCE II is more involved and your computer forensics experience from the ENCE I and your workplace will be of a great assistance here. To find out more about the computer forensic courses and what is right for you visit www.KnowledgeCenterInc.com for more details.
Mark Grey