This is a 4 day course.

Alcohol Tobacco Firearms & Explosives (ATF) lab in Ammendale MD

Travel, lodging, and meal expenses are the responsibility of the student or his or her laboratory.

The only prerequisite is current or projected work as a fire debris analyst.  The course is designed to meet the needs of new fire debris analysts, but the experienced analyst may also gain significant benefit from the curriculum.

March 27-31, 2006

Location: Bureau of Alcohol Tobacco, Firearms and Explosives (ATF) laboratory in Ammendale, MD

Travel, lodging, and meal expenses are the responsibility of the student or his or her laboratory.

This course provides students with the knowledge and skills necessary to install, configure, and effectively use the combined abilities of AccessData’s Forensic Toolkit (FTK) and Password Recovery Toolkit (PRTK) to locate and examine e-mail messages, deleted files, free space and file slack.

Additionally, students will learn how to search for and export graphic files, as well as export and gain access to encrypted files from multiple industry standard applications. Documenting digital media information and working with multiple forensic image formats are also explored.

The hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and Security and Network Administrators that are responsible for creating cases that examine, analyze, and classify digital evidence.

None

NCFS

Training & Ultimate Toolkit (UTK) Software Package $2295.00
Training with NO Software $1695.00

This course provides students with the knowledge and skills necessary to conduct an effective Internet application based investigation. Students should already be conducting computer based investigations and be familiar with the AccessData suite of tools. Internet based investigations experience would provide additional background knowledge but is not necessary. This is not an undercover investigations course - it is data recovery focused. Students begin immediately working a missing person case initiated from an instant message found on the computer screen of the missing person. The case takes the student to several different machines with multiple internet chat, browsing and email platforms. In addition to using Password Recovery Toolkit (PRTK) to break sign-on passwords for the following Internet applications and Messengers:

• MSN Instant Messenger
• YAHOO Instant Messenger
• America Online and AOL Instant Messenger
• Internet Explorer and Netscape Communicator Auto-Complete

Students will also utilize Forensic Toolkit (FTK) to locate and decrypt YAHOO Instant Messenger .DAT files, parse Internet Explorer .DAT files (History and Temporary Files) for hit rates, use counts and more - including Netscape history files, the download manager, user favorites, etc. Students will also parse America Online client files for user history, search terms, address books, buddy lists, email and more. Students will use the Registry Viewer to analyze Instant Messenger data such as:

• Shared file permission status and file transfer information
• Block or allow information for user contacts (buddy lists)
• Last user access information and Recent contacts via the messenger

The advanced hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and security and network administrators who desire a greater understanding of Internet artifact data recovery.

NCFS

Training & Ultimate Toolkit (UTK) Software Package $2495.00
Training with NO Software $1895.00