This is a 5-day certification course is designed for the investigator/examiner entering the field of digital forensics that provides the fundamental knowledge to comprehend and investigate incidents involving electronic devices.  The course begins with detailed discussions on digital forensic examination principles and first responder responsibilities.  Using industry core principles students will learn how to forensically collect and image evidence for examination and how digital fingerprints can be used to verify data integrity.

Attendees will gain insight into partitioning structures and disk layouts and the effects of formatting volumes that contain existing data.  The course covers in-depth analysis and functionality of the FAT File System and its related metadata pertaining to stored objects within the volume.   File management and directory structure characteristics will be examined in detail as well as techniques for discovering potential evidence that may be pivotal to a successful examination.  Midway within the course students will learn of core artifacts of interest in a Windows-based examination, focusing on user interaction with files and applications through typical daily use and account ownership analysis.  This is a certification course where attendees can participate in the optional exam conducted at the conclusion of the course.