The National White Collar Crime Centre (NW3C) - “a non-profit organization funded by the U.S. Department of Justice, Bureau of Justice Assistance, provides support to local and state enforcement agencies involved in the prevention, investigation, and prosecution of economic and high-tech crime.”

Course Information:

Basic Data Recovery and Analysis - The course includes hands-on instruction and discussion about such topics as evidence identification and extraction, hardware and software needed to do a seizure, how to recover erased files, how to overcome encryption, high-tech legal issues, and more.

Advanced Data Recovery and Analysis, Windows 95 through ME – This course is designed to take the officer who is proficient with the fundamentals of computer-based evidence into the more varied and complex technical terrain of the Windows 95, Windows 98, and Windows Millennium operating systems. Topical areas include LBA and hard drive access, partition table reconstruction, advanced imaging and restoration, long file names, date/time stamps, the recycle bin, recovering data from the registry, recovering Windows-based passwords, and processing the swap file, slack space and unallocated space, alternate media, print spool files, and application metadata.

Advanced Data Recovery and Analysis, Windows NT through XP - This course is designed to be an introduction to processing issues related to the Windows NT, Windows 2000, and Windows XP operating systems. Topical areas include a detailed look at the New Technology File System (NTFS), the encrypting file system (EFS), dynamic disks, directory junctions, volume mount points, and processing issues such as recovering erased files, examination of the pagefile, unallocated space and slack space, recovering information from the registry and methods of gaining operating system and filesystem access.

Advanced Data Recovery and Analysis, Internet Trace Evidence - This course is designed to teach the recovery of data from a computer that has been connected to the Internet and using America Online (AOL), AOL Instant Messenger (AIM), Compuserve 2000 (CIS), Internet Explorer and/or Netscape Navigator clients. Topical areas include the recovery and examination of cookie, cache, and history files; browser-related activity that is maintained by the registry; recovering AOL stored e-mail and buddy lists, etc.

Last modified: