EnCase Advanced Computer Forensic


EnCase® Advanced Computer Forensics

This hands-on course is designed for examiners with advanced computer skills and two or more years of experience working in the field of computer forensics. Participants learn to use some of the more advanced features of EnCase® Forensic Version 7 (EnCase v7) while examining operating and file system artifacts from the Microsoft Windows operating systems. The course demonstrates advanced methods of data recovery and identification and recovery of encrypted data.
Delivery method: Group-Live. NASBA defined level: advanced.
This course provides in-depth coverage on topics, including:
• Examination of the Microsoft Windows Registry
• The use of block-based file hash analysis for file recovery
• Examination of Volume Shadow Copy (VSC) data maintained by the Windows Volume Shadow Service (VSS)
• Examination and recovery of Windows event logs
• Hardware and software RAID technology, acquisition, and examination
• Using Windows operating system artifacts to identify the use of removable USB devices
• The purpose and function of prefetch files and how to analyze them
• Principles of encrypted data recovery
• Various techniques on the examination RAM
• Examining Windows® Search data
• Low-level data recovery from Zip files and the latest version of Microsoft® Word documents
• Examining smartphones with EnCase v7




Training Schedule & Training Fees


EnCase Advanced Computer Forensics Training

Time: 09:00 to 18:00   <Four-Days>
Venue: Hong Kong
Training Fees: HK$ 22,000 per student

Medium of instruction: Taught in English Language

Schedule : 21-24 June 2016


EnCase® v7 Computer Forensics II
​ or EnCE® Certification.


Who Should Attend:
​This course is intended for law enforcement officers, computer forensic examiners, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics is required. The class curriculum builds upon the foundation of the EnCase® Computer Forensics II course, continuing with a focus on file and operating system examinations.




•  Limited offer, first come first served.
•  A Performer Ltd reserves the right to change the promotion detail without prior notice.
•  A Performer Ltd reserves the right to final decision.   
•  The course will not commence unless there is a sufficient number of enrolled students.
•  All fees paid are neither refundable nor transferable.



Leading to the EnCase Certified Examiner (EnCE)

The EnCase® Certified Examiner (EnCE®) program certifies both public and private sector professionals in the use of Guidance Software's EnCase® computer forensic software. EnCE® certification acknowledges that professionals have mastered computer investigation methodology as well as the use of EnCase® software during complex computer examinations. Recognized by both the law enforcement and corporate communities as a symbol of in-depth computer forensics knowledge, EnCE certification illustrates that an investigator is a skilled computer examiner.