AccessData Internet Forensics 11/11 - 11/13
Tuesday, November 11, 2008 9:00 am -
Thursday, November 13, 2008 5:00 pm (Central Time)
Northwest Forest Conference Center
Cypress Software Room
12715 Telge Road
Cypress, Texas 77429
 Map and Directions
This course provides students with the knowledge and skills necessary to conduct an effective Internet application based investigation. Students should already be conducting computer based investigations and be familiar with the AccessData suite of tools. Internet based investigations experience would provide additional background knowledge but is not necessary. This is not an undercover investigations course - it is data recovery focused.
Students begin immediately working a missing person case initiated from an instant message found on the computer screen of the missing person. The case takes the student to several different machines with multiple internet chat, browsing and email platforms. In addition to using Password Recovery Toolkit (PRTK) to break sign-on passwords for the following Internet applications and Messengers:
o MSN Instant Messenger (including MSN Live)
o YAHOO Instant Messenger
o America Online and AOL Instant Messenger
o Internet Explorer and Firefox Auto-Complete
o Myspace
o Skype
o Internet Explorer 7 Intelliforms artifacts
Students will also utilize Forensic Toolkit (FTK) to locate and decrypt YAHOO Instant Messenger .DAT files, parse Internet Explorer .DAT files (History and Temporary Files) for hit rates, use counts and more - including Firefox history files, the download manager, user favorites, etc. Students will also parse America Online client files for user history, search terms, address books, buddy lists, email and more. Students will use the Registry Viewer to analyze Instant Messenger data such as:
o Shared file permission status and file transfer information
o Block or allow information for user contacts (buddy lists)
o Last user access information and Recent contacts via the messenger
This advanced level, hands-on intensive course is intended for Forensic Investigators, Law Enforcement Personnel and security and network administrators who desire a greater understanding of Internet artifact data recovery.
Courses outside North America include an overview of Peer to Peer file sharing programs such as Limewire and the network architecture on which they operate. America Online course content has been removed providing the ability for delegates to explore such forensic issues as:
o Examining P2P actvity log files
o Decrypting Kazaa registry search terms
o Determining download file sources
o Determining file and folder share status
o Decoding URL values for download file comparison by hash value
The Internet Forensics course includes an optional Practical Skills Assessment (PSA) that requires participants to apply concepts presented during the course to complete a practical exercise. Participants who successfully complete this exercise receive a certificate of PSA completion.
The cost for the 3 day course is $2,495 per person.
We recommend out of town participants arrive in Houston the evening before class starts. The classroom holds 16 people and we will be full. As such please confirm the number of attendees ASAP.
In regards to the lodging, we have a limited number of rooms available at the conference center starting at $85 (plus tax) per night. To reserve, please contact Northwest Forest Conference Center. where the training is held, at 800-256-3548. Please use Trial Solutions' name when calling.
A rental car is recommended for transportation. Although there are two restaurants within walking distance to the hotel conference center, students may find a rental car helpful. Taxi service typically costs around $70 one-way, to/from the airport to/from the conference center.
For those that are flying out the same day the course ends, we recommend scheduling flights after 7:30PM to ensure plenty of time to get to the airport. We recommend flying in and out of Houston Intercontinental Airport (IAH) as it is about 40 minutes from the conference center.
|
You may pay by check, credit card or wire transfer. If paying by wire transfer, we will contact you with details for completing your purchase after you complete your registration. If paying by check, we must receive your payment before your registration will be complete.
|