4-day Advanced Level Course

Course Overview

The Advanced Windows® 10 Forensic analysis class is an expert-level four-day training course, designed for examiners who are familiar with the principles of digital forensics and keen to expand their knowledge on advanced forensics using a host of third-party tools to improve their computer investigations.

The Spyder Forensic Advanced Windows® 10 Forensic Analysis course will give participants unbiased knowledge and skills necessary to analyze artifacts left behind through system and user interaction with the host system, utilizing industry standard tools and open source applications to explore the data in greater depth by learning how applications function and store data in the file system.

Students will learn to use various applications and utilities to successfully identify, process, understand and document numerous Windows® artifacts that are vitally important to forensic investigations. The participant will also gain knowledge on how to process Edge browser history, cookies, temp files InPrivate browsing challenges and analysis, BitLocker encryption, Windows® Action Center, TimeLine and other Windows® 10 specific artifacts. The course includes gaining in-depth knowledge of JumpLists, Registry analysis and prefetch files and how they relate to forensic investigations and conclude with an in-depth look at OneDrive and synchronization processes between trusted devices.

Students will use a variety of open source and leading forensic applications to examine key artifacts through multiple hands-on labs and student practicals.

Click here to inquire about this course

4-day Advanced Level Course

This 4-Day intermediate class is designed to provide the student with the skills and techniques to response to a cyber intrusion incident. The students will learn the anatomy of an intrusion, collection of memory and volatile artifacts, and techniques to unravel the mystery of how the network was compromised.

The course will follow adult learning principles through training aids such as presentations, diagrams and practical instructor lead examples. Each artifact covered will be presented in either one or two 50 minute sessions followed by review questions. Students will be given the opportunity throughout the course to ask questions and discuss objectives covered in more detail. Throughout each day students will have practical exercises to work on in order to reinforce the topics with a final practical at the culmination of the training.

This hands-on course is geared towards forensic investigators with 6+ months experience in forensic case work with a basic understanding of Microsoft data structures.

About the Trainer

Charles Giglia has been in the field of computer forensics since 2000 concentrating primarily on the research and development of computer forensic investigative techniques and training curriculum. Charles has an undergraduate degree in mathematics from Canisius College and a graduate degree in forensic science from the University of New Haven. Charles had been deployed nearly 18 months from 2007 to 2009 doing computer forensic investigations in support of Operation Iraqi Freedom while serving as a U.S. Army Contractor in Baghdad. Previously he spent six years as a Computer Crime Specialist with the NW3C while leading the development of numerous training classes. His primary concentrations were courses related to Internet investigations and Internet forensics. Charles has been a guest presenter at the FBI training academy, as well as several IACIS, FACT, RCFG/GMU, HTCIA international/regional conferences and an adjunct professor at Fairmont State College. He is a Certified Forensic Computer Examiner (CFCE) and a Red Hat Certified Engineer (RHCE).

Click here to inquire about this course

3-day Advanced Level Course

Course Overview

This three-day advanced level course will equip you with the practical skills and competencies required to identify and extract various sources of data recoverable from Unmanned Aircraft Systems (UAS), also known as Drones, including their associated control devices in line with approved best practices.

Using leading research and development from Spyder Forensics, this course will introduce you to the world of UAV’s and instruct you how to fly a Drone followed by best practices in conducting forensically sound extractions and analysis of UAS data for use as evidence or intelligence gathering. Attendees will learn how to collect data from within the aircraft using non-destructive processes utilizing industry-standard tools to create forensic collections of storage media that include flight logs, aircraft data, photo, and video files without the need to disassemble the aircraft or controller. Students will then learn procedures in the acquisition of application data found on the mobile device.

Once data has been acquired, attendees will master how to analyze the flight logs and user data using software originally designed to work with these types of structures, gaining knowledge on workflows to connect data between the drone application and the flight data recovered from the aircraft.

This course uses non-destructive processes to extract and analyze the data from all hardware in the UAS including the handheld device, mobile application, and drone. All software used in class can be used in the DFIR lab free of charge and without the need to purchase additional applications to conduct a Drone examination.

Primary Learning Objectives 

• Introduction to UAV Forensics
• Explore the various components of sUAS
• Learning to Fly – Attendees will each receive a Drone and be taught how to fly the aircraft
• Best practices in the extraction of data from all components associated with the device
• Examination and Interpretation of collected data
• Advanced Analysis Techniques
• Learn how to produce a forensic report to support examination of UAV

All attendees of the Spyder Forensic Drones course will take home a UAV and other hardware to conduct an analysis of a UAV.

Click here to inquire about this course

5-Day Foundation Level Course

This Cryptocurrency Foundation Course for Investigators is a hands-on practical 5-day training program designed for investigators who want to advance their knowledge of bitcoin, the blockchain, cryptocurrency, and its criminal applications.

Students will learn about a variety of private key hiding places, see examples of “hidden in plain sight” private keys and practice a search of a hidden private key in plain sight.
Attendees will know the purpose and functionality of typical crypto exchanges and visit several exchanges.

Participants will understand the similarities and differences between and ICO and an IPO, articulate how cryptocurrencies are launched and discuss the process of a pump and dump scheme. Students will gain knowledge about coins and tokens, describe how tokens gain value and differentiate between utility tokens and security tokens.

Course participants will become proficient in Bitcoin and Altcoin basics, the Blockchain, cryptocurrencies wallets, exchanges, transactions, and do hands-on exercises on the five most common Hardware Wallets.

Click here to inquire about this course

3-day Intermediate Level Course

Course Overview

This three-day course is designed for the examiner tasked with recovery of data on collected electronic evidence.  The course covers in depth architecture and functionality of the Windows New Technology File System (NTFS), the FAT and the ExFAT File Systems and related directory entry information for locating files on electronic devices.  Attendees will gain insight into partitioning structures and disk layouts and the effects of formatting partitions and learn of system area data. File management and directory structures characteristics will be examined in detail as well as techniques for discovering potential evidence that maybe pivotal to a successful examination. This will be followed by topical areas of interest to include file headers and file hashing and recovery of deleted files.

Click here to inquire about this course

4-day Advanced Level Course

Course Overview

The Advanced Windows® 10 Forensic analysis class is an expert-level four-day training course, designed for examiners who are familiar with the principles of digital forensics and keen to expand their knowledge on advanced forensics using a host of third-party tools to improve their computer investigations.

The Spyder Forensic Advanced Windows® 10 Forensic Analysis course will give participants unbiased knowledge and skills necessary to analyze artifacts left behind through system and user interaction with the host system, utilizing industry standard tools and open source applications to explore the data in greater depth by learning how applications function and store data in the file system.

Students will learn to use various applications and utilities to successfully identify, process, understand and document numerous Windows® artifacts that are vitally important to forensic investigations. The participant will also gain knowledge on how to process browser artifacts, learn how BitLocker encryption functions, gain in-depth knowledge of SQL analysis to prepare for the analysis of Windows® Action Center, TimeLine and other Windows® 10 data stored in these databases. The course includes gaining in-depth knowledge of JumpLists, Registry analysis and prefetch files and how they relate to forensic investigations and conclude with an in-depth look at OneDrive and synchronization processes between trusted devices.

Students will use a variety of open source and leading forensic applications to examine key artifacts through multiple hands-on labs and student practicals.

Click here to inquire about this course

4-day Advanced Level Course

This 4-Day intermediate class is designed to provide the student with the skills and techniques to response to a cyber intrusion incident. The students will learn the anatomy of an intrusion, collection of memory and volatile artifacts, and techniques to unravel the mystery of how the network was compromised.

The course will follow adult learning principles through training aids such as presentations, diagrams and practical instructor lead examples. Each artifact covered will be presented in either one or two 50 minute sessions followed by review questions. Students will be given the opportunity throughout the course to ask questions and discuss objectives covered in more detail. Throughout each day students will have practical exercises to work on in order to reinforce the topics with a final practical at the culmination of the training.

This hands-on course is geared towards forensic investigators with 6+ months experience in forensic case work with a basic understanding of Microsoft data structures.

About the Trainer

Charles Giglia has been in the field of computer forensics since 2000 concentrating primarily on the research and development of computer forensic investigative techniques and training curriculum. Charles has an undergraduate degree in mathematics from Canisius College and a graduate degree in forensic science from the University of New Haven. Charles had been deployed nearly 18 months from 2007 to 2009 doing computer forensic investigations in support of Operation Iraqi Freedom while serving as a U.S. Army Contractor in Baghdad. Previously he spent six years as a Computer Crime Specialist with the NW3C while leading the development of numerous training classes. His primary concentrations were courses related to Internet investigations and Internet forensics. Charles has been a guest presenter at the FBI training academy, as well as several IACIS, FACT, RCFG/GMU, HTCIA international/regional conferences and an adjunct professor at Fairmont State College. He is a Certified Forensic Computer Examiner (CFCE) and a Red Hat Certified Engineer (RHCE).

Click here to inquire about this course

4-day Advanced Level Course

Course Overview

The Advanced Windows® 10 Forensic analysis class is an expert-level four-day training course, designed for examiners who are familiar with the principles of digital forensics and keen to expand their knowledge on advanced forensics using a host of third-party tools to improve their computer investigations.

The Spyder Forensic Advanced Windows® 10 Forensic Analysis course will give participants unbiased knowledge and skills necessary to analyze artifacts left behind through system and user interaction with the host system, utilizing industry standard tools and open source applications to explore the data in greater depth by learning how applications function and store data in the file system.

Students will learn to use various applications and utilities to successfully identify, process, understand and document numerous Windows® artifacts that are vitally important to forensic investigations. The participant will also gain knowledge on how to process Edge browser history, cookies, temp files InPrivate browsing challenges and analysis, BitLocker encryption, Windows® Action Center, TimeLine and other Windows® 10 specific artifacts. The course includes gaining in-depth knowledge of JumpLists, Registry analysis and prefetch files and how they relate to forensic investigations and conclude with an in-depth look at OneDrive and synchronization processes between trusted devices.

Students will use a variety of open source and leading forensic applications to examine key artifacts through multiple hands-on labs and student practicals.

Click here to inquire about this course

5-Day Foundation Level Course

This Cryptocurrency Foundation Course for Investigators is a hands-on practical 5-day training program designed for investigators who want to advance their knowledge of bitcoin, the blockchain, cryptocurrency, and its criminal applications.

Students will learn about a variety of private key hiding places, see examples of “hidden in plain sight” private keys and practice a search of a hidden private key in plain sight.
Attendees will know the purpose and functionality of typical crypto exchanges and visit several exchanges.

Participants will understand the similarities and differences between and ICO and an IPO, articulate how cryptocurrencies are launched and discuss the process of a pump and dump scheme. Students will gain knowledge about coins and tokens, describe how tokens gain value and differentiate between utility tokens and security tokens.

Course participants will become proficient in Bitcoin and Altcoin basics, the Blockchain, cryptocurrencies wallets, exchanges, transactions, and do hands-on exercises on the five most common Hardware Wallets.

Click here to inquire about this course

5-Day Advanced Level Course

This Advanced Cryptocurrency Investigator Course is a hands-on practical 5-day multi-instructor-led interactive program designed for law enforcement officials, intelligence analysts, and investigators who want to significantly advance their cryptocurrency investigation and seizure skills. Participants will gain valuable knowledge and a high level of competence through “doing” instead of just watching.

Through a rigorous program of exercises students will become fully practiced and confident in their ability to identify, recover, seize, and restrain cryptocurrencies quickly, securely and properly. Participants will gain critical experience in Cold Storage and the proper transfer of cryptocurrency from a suspect’s wallet to an agency owned wallet during the execution of a search warrant.

Working with different devices participants will learn how to efficiently use the 25 most common hardware wallets, utilize, crack, recover and update different versions of firmware for a variety of hardware wallets, and restore wallets from corrupted devices such as desktops, tablets, and mobile devices. Participants will be accomplished in creating a blockchain, developing their own Tokens, running a node and creating smart contracts all on their own.

Law enforcement, intelligence analysts, and investigators will gain experience in establishing an agency wallet, identifying evidence of cryptocurrency on devices using the advanced search and forensic techniques, identifying paper wallets, finding hidden or obscure cold storage hiding places and discovering hidden Mnemonic BIP39 seeds. After that, participants will go through a rigorous program of exercises and practice the proper seizure, transfer, and storage of cryptocurrency funds.

Participants will know how to secure storage of cryptocurrency to prevent, avoid bad seized cryptocurrency transfers, and recover from a bad seized currency transfer if that happens. Through hands-on practical exercises, participants will become proficient in their ability to decrypt cryptocurrency wallets, recover Private Key QR Codes, perform independent BIP38 password recovery, and access inaccessible wallets.

Click here to inquire about this course

5-Day Advanced Level Course

This Advanced Cryptocurrency Investigator Course is a hands-on practical 5-day multi-instructor-led interactive program designed for law enforcement officials, intelligence analysts, and investigators who want to significantly advance their cryptocurrency investigation and seizure skills. Participants will gain valuable knowledge and a high level of competence through “doing” instead of just watching.

Through a rigorous program of exercises students will become fully practiced and confident in their ability to identify, recover, seize, and restrain cryptocurrencies quickly, securely and properly. Participants will gain critical experience in Cold Storage and the proper transfer of cryptocurrency from a suspect’s wallet to an agency owned wallet during the execution of a search warrant.

Working with different devices participants will learn how to efficiently use the 25 most common hardware wallets, utilize, crack, recover and update different versions of firmware for a variety of hardware wallets, and restore wallets from corrupted devices such as desktops, tablets, and mobile devices. Participants will be accomplished in creating a blockchain, developing their own Tokens, running a node and creating smart contracts all on their own.

Law enforcement, intelligence analysts, and investigators will gain experience in establishing an agency wallet, identifying evidence of cryptocurrency on devices using the advanced search and forensic techniques, identifying paper wallets, finding hidden or obscure cold storage hiding places and discovering hidden Mnemonic BIP39 seeds. After that, participants will go through a rigorous program of exercises and practice the proper seizure, transfer, and storage of cryptocurrency funds.

Participants will know how to secure storage of cryptocurrency to prevent, avoid bad seized cryptocurrency transfers, and recover from a bad seized currency transfer if that happens. Through hands-on practical exercises, participants will become proficient in their ability to decrypt cryptocurrency wallets, recover Private Key QR Codes, perform independent BIP38 password recovery, and access inaccessible wallets.

Click here to inquire about this course

5-Day Foundation Level Course

This Cryptocurrency Foundation Course for Investigators is a hands-on practical 5-day training program designed for investigators who want to advance their knowledge of bitcoin, the blockchain, cryptocurrency, and its criminal applications.

Students will learn about a variety of private key hiding places, see examples of “hidden in plain sight” private keys and practice a search of a hidden private key in plain sight.
Attendees will know the purpose and functionality of typical crypto exchanges and visit several exchanges.

Participants will understand the similarities and differences between and ICO and an IPO, articulate how cryptocurrencies are launched and discuss the process of a pump and dump scheme. Students will gain knowledge about coins and tokens, describe how tokens gain value and differentiate between utility tokens and security tokens.

Course participants will become proficient in Bitcoin and Altcoin basics, the Blockchain, cryptocurrencies wallets, exchanges, transactions, and do hands-on exercises on the five most common Hardware Wallets.

Click here to inquire about this course