Advanced Database Forensics (Live on-site – September 2022)
5-day Advanced Course – Live on-site
Course Overview
Learn to use various applications and utilities to successfully identify, process, understand and exploit numerous database structures found on iOS, Android, Windows and Apple systems.
Students will gain knowledge in how relational databases function in the storage of records and fields of information to support a front-end application. SQLite will be covered in great detail where the attendee will learn how to recover deleted information from Free Pages and unallocated space within the primary and journal files using scripting techniques. Additional databases will then be examined including ESE, MS Compound, UAV Data-files, and Binary Plists.
Students will examine data from a host of systems including: Mac, Windows, Android, iPhone.
We will use a variety of open source and leading forensic applications to examine key artifacts through multiple hands-on labs and student practicals.
The course will follow adult learning principles through training aids such as presentations, diagrams and practical instructor lead examples. Each artifact covered will be presented in either one or two 50-minute sessions followed by review questions. Students will be given the opportunity throughout the course to ask questions and discuss objectives covered in more detail. Throughout each day students will have practical exercises to work on in order to reinforce the topics.