This 2.5-days course include:

X-WAYS 1 is a prerequisite for this X-WAYS 2 course.

Topics include:

• .e01 evidence file format
• Creating skeleton images
• Creating cleansed images
• Sector superimposition
• Working with evidence file containers
  • Creating containers, understanding the available options
  • Adding files to containers from various sources
  • Closing containers, optionally converting them
  • Using containers as evidence objects
• Finding and analyzing deleted partitions
  • Reconstructing RAID and Linux MD RAID systems
  • Practical examples for RAID 0 and RAID 5
  • Explanation of underlying data arrangements
  • Clues towards finding the right parameters
• FuzZyDoc
• Conditional cell coloring
• Custom tooltips and keyboard shortcuts
• Registry Viewer and Registry Reports, Registry Report definition files
• How X-Tensions work
• Recovering deleted NTFS-compressed files manually
• Block-wise hashing and matching
• Command line usage of X-Ways Forensics
• Indexing
• Customizing the registry report
• Templates

* CHANGES TO COURSE CONTENT AND PROVIDED SOFTWARE CAN BE MADE WITHOUT PRIOR NOTICE.

CDFS reserves the right to cancel this class due to either insufficient enrolment and/or unforeseen difficulties arising from the delivery.