CIT256

This course provides students with the knowledge and skills needed to master Windows forensic analysis topics using industry standard forensic tools. Areas addressed in this course include the New Technology File System (NTFS), steganography, case management, data acquisition and verification, bookmarking, search methodologies, signature and hash analysis, recovering data in unallocated space, examining Windows artifacts, parsing compound files, decoding encrypted data, and case reporting.