Applied NT Forensics

Who Should Attend?


This course is designed for computer forensic professionals seeking to enhance their knowledge of the evidential opportunities within the NT-based system.

Course / Module entry requirements


Designed for experienced forensic computer analysts who have attended the NPIA Core Skills in Data Recovery and Analysis course or similar and have at least 12 months experience in a forensic computing environment.

No. of courses being run


2011/12 (full year): 2

2012/13 (half year): 1

Dates and Venues


 From: 06 Feb 2012  To: 10 Feb 2012
 Venue: Wyboston  Places: Available


 From: 28 May 2012  To: 01 Jun 2012
 Venue: Ryton  Places: Available


 From: 22 Oct 2012  To: 26 Oct 2012
 Venue: Ryton  Places: Available

Course / Module duration

5 days

Assessment process / accreditation details

Students attending this course will undertake a final assessment.

Successful completion of this course will allow 10 credits to be obtained towards the MSc in Cybercrime Forensics offered by Canterbury Christ Church University.

Additional Information

Prices below current until 31 March 2012

ALL COURSE DATES AFTER 31ST MARCH 2012 WILL BE SUBJECT TO A PRICE INCREASE

For bookings and enquiries, please contact

Tel: 01480 401856
Email: 
enquiries_hightechcrime@npia.pnn.police.uk

Cost to HO Forces

£1279 Residential

£776 Non-Residential

Cost to non HO Forces

£N/A Residential


£N/A Non-Residential

Overview


In depth technical knowledge is introduced in a mixture of trainer led presentations and practical sessions allowing students to fully understand and implement their new skills with purpose and effect.

Aims


The release of Microsoft Vista and the predominance of NT-based computers running on NTFS file systems requires forensic examiners to have a robust understanding of these structures. 

This course will enable examiners to recover evidence more effectively and have a much better understanding of what their automated forensic tools are doing. 

They will be better prepared to assemble evidence for courts that is clear and supportive of evidential needs.

Objectives


  • Interrogate, interpret and recover potential evidence found on Vista and other NT-based computers running on NTFS file systems. 
  • The registry, recycle bin, master file table and other operating system and file system structures likely to hold evidential data will be examined and explained at their fundamental levels.