Train On-Demand
Choose the training you want from 18,000+ videos of instructor-led content. Watch anywhere.
Learn MoreDigital Forensics: File & Disk Analysis
What about this course?
<br>In this course, you will learn how to interact with the lower levels of files and disks. Specifically, you will understand the file’s structure and learn how to identify various file types. File’s metadata will also be demystified in this section. You will then get familiar with disk drives, their types, and schemes used today by our systems. Volumes and partition concepts are up next. You will learn what they are, how to identify them and the techniques you can use to analyze them. Finally, you will dive into the world of file systems. You will be shown how to analyze FAT and NTFS file system structures and how to apply file carving techniques to retrieve previously removed data. You will have the chance to try each tool and technique mentioned in hands-on and practical labs.</br> <br>This course is part of the Digital Forensics Professional Learning path which prepares you for the eCDFP exam and certification</br>
Duration
10 hours
Difficulty
professional
INE's world-class IT trainingInstructor for this course
Ali Hadi
This course is composed by the following modules
INE's world-class IT training
Module 1
Data Representation & Files Examination1 iframe, 3 videos, 4 labs
Data Representation & Files Examination - Study Guide
Analyzing Files Based on Their Headers
Extracting and Analyzing EXIF Data
Image Document Analysis Using Ghiro
Basic File Header Analysis
Lab 4 - Extracting Metadata from Documents
Lab 5 - Basic PDF Analysis
Lab 6 - Analyzing Microsoft Office Documents
Module 2
Disks1 iframe, 1 lab, 2 videos
Disks - Study Guide
Basic Disk Analysis Using WinHex
Performing Disk Analysis Procedures on a Suspect's Disk
Lab 7 - Recovering a Corrupted Disk - MBR Case
Module 3
File Systems1 iframe, 5 labs, 6 videos
File Systems - Study Guide
Lab 9 - Locating Hidden Partitions and Partition Gaps
Creating a File System Testing Environment Using a VirtualBox
Introduction to Analyzing a FAT File System Using WinHex
Manually Analyzing File DataRuns
Automatic File Carving
Working with Autopsy3
Working with Autopsy3 Manual File Carving
Lab 10 - Analyzing FAT File System
Lab 11 - Investigating Deleted Files Formatted Disks and Slack Space
Lab 12 - Walking through NTFS File System Attributes
Lab 13 - File Carving and Creating Custom Signatures
Nail Your Next Project
Take your technical training into your own hands and stay engaged with our learn-by-doing platform where you can put your skills to the test with hands-on exercises, quizzes, and labs.
Get Hands-On
INE quizzes, labs, projects, and exercises help reinforce your knowledge.
Learn MoreLearning Paths
Organized training helps guide you through the most relevant subjects for certification prep.
Learn MoreAccess to All Courses & Updates
We add new courses and learning materials to the platform weekly so you're always up-to-date.
Learn MoreCommon Course Questions
If you have a question you don’t see on this list, please visit our Frequently Asked Questions page by clicking the button below.
If you’d prefer getting in touch with one of our experts, we encourage you to call one of the numbers above or fill out our contact form.
Do you offer training for all student levels?
