EnCase Computer Forensic Training 

Training Schedule

<Four Days (0900~1800) - 32 hours>  

Medium of instruction : Taught in English Language
Instructors : High qualified instructors in Computer Forensics field

Venue : Hong Kong (will be advise)

DF120  -  Foundations in Digital Forensics with EnCase® Forensic   
Course Level : Introductory

*   coming soon (will be advise)   < Tuesday ~ Friday >

Training Fee : HKD 21,500 per seat

DF210  -  Building an Investigation with EnCase® Forensic           
Course Level : Intermediate

*   coming soon (will be advise)   < Tuesday ~ Friday >

Training Fee : HKD 21,500 per seat


DF120 – Foundations in Digital Forensics with EnCase® Forensic

    Course Level: Introductory

    Delivery Method: Group-Live, Classroom


This hands-on course involves practical exercises and real-life simulations in the use of EnCase® Forensic 8. This class is the new name of Encase Computer Forensic I (CF I).
The class provides participants with an understanding of the proper handling of digital evidence from the initial seizure of the computer/media to acquisition, including the use of FastBloc® SE and remote acquisition using Encase® Direct Network preview. Instruction then progresses to the analysis of the data. It concludes with archiving and validating the case and its associated data.


Who Should Attend:

This course is intended for IT security professionals, litigation support and forensic investigators Participants may have minimal computer skills and may be new to the field of computer forensics.


DF210 - Building an Investigation with EnCase Forensic

    Course Level: Intermediate

    Delivery Method: Group-Live, Classroom


**Formerly EnCase v7 Computer Forensics II training


This hands-on course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the EnCase® Forensic. This course builds upon the skills covered in the DF120 - Foundations of Digital Forensics course and enhances the examiner's ability to work efficiently through the use of the unique features of EnCase®. It is essential that students fully understand evidence handling, the structure of the evidence file, creating and using case files, and data acquisition methods, including DOS-based, hardware write protected, crossover cable, and disk-to-disk acquistion. It is also important that the students are familiar with the methods for recovering deleted files and folders in a FAT environment, conducting keyword searches across logical and physical media, creating and using EnCase® bookmarks, file signatures and signature analysis, and locating and understanding Windows® artifacts.



Who Should Attend:

This course is intended for IT security professionals, litigation support, and forensic investigators. Participants should have attended the Guidance Software course, DF120 – Foundations of Digital Forensics or EnCase v7 Computer Forensics I

Focusing on commonly conducted investigations, students will learn about the following:

•    How to recover encrypted information particularly that which was encrypted using Windows BitLocker™

•    How to locate and recover deleted partitions

•    Students will learn how to deal with compound file types

•    Students will learn about the Windows® Registry

•    How to determine time zone offsets and properly adjust case settings

•    How to create and use conditions for effective searching

•    Students will learn how to use the EnCase® Evidence Processor

•    Students will gain an overview of the FAT, ExFAT, and NT file system

•    How to conduct keyword searches and advanced searches using GREP

•    The differences between single and logical evidence files and how to create and use of logical evidence files

•    How to identify Windows operating system artifacts, such as link files, Recycle Bin, and user folders

•    How to recover data from the Recycle Bin

•    How to recover artifacts, such as swap files, file slack, and spooler files

•    How to conduct a search for e-mail and e-mail attachments

•    Students will learn how to examine e-mail and Internet artifacts

•    How to identify and recover data relating to the use of removable USB devices



Leading to the EnCase Certified Examiner ( EnCE )


EnCE® Certification Program

The EnCase® Certified Examiner(EnCE®) program certifies both public and private sector professionals in the use of Guidance Software's EnCase computer forensic software. EnCE certification acknowledges that professionals have mastered computer investigation methodology as well as the use of EnCase software during complex computer examinations. Recognized by both the law enforcement and corporate communities as a symbol of in-depth computer forensics knowledge, EnCE certification illustrates that an investigator is a skilled computer examiner.