Guidance Software Training

Transcription

1 GUIDANCE SOFTWARE Training Guidance Software Training Real-world Experience with Guidance Software Training

2 GUIDANCE SOFTWARE Training Guidance Software Training Who Benefits from Training? All EnCase software users from the novice to the seasoned professional All government agencies and private organizations that are responsible for analysis of electronic media The digital investigations training specialists at Guidance Software have trained more than 60,000 students. We at the Schaumburg (Illinois) Police Department strive to be at the forefront of law enforcement, and Guidance Software s EnCase products and training programs are a part of that effort. From cutting-edge training courses to flexible training options such as the Training Annual Passport, we ve found Guidance Software to be at the top of their game and their products, training programs and certifications such as the EnCase Certified Examiner (EnCE) becoming the industry standard. -Commander Dawn McDermott, Investigations Division Commander, Schaumburg Police Department Corporations and government agencies use EnCase software to search, collect, preserve, and analyze digital information for the purposes of computer forensics investigations, information assurance, e-discovery collection, data loss prevention, compliance with mandated regulations and more. Guidance Software Training courses and programs help organizations maximize their use of EnCase products. The best training available on critical, real-world issues Guidance Software offers world-class training in enterprise investigations, such as e-discovery and computer security incident response, and forensic investigations, including law enforcement and fraud investigations. Stay ahead of the curve Whether you want to learn state-of-the-art practices in digital forensics or get up to speed with the most advanced technology available, EnCase training from Guidance Software is the standard across all industries. After training more than 60,000 investigative professionals, no one can deliver more focused, tactical, and expert knowledge about EnCase and digital investigations as a practice. Learn the latest technology and techniques and advance your career with Guidance Software Training. As the volume and sophistication of digital investigations continue to increase, investigators can stay ahead of the curve and maintain departmental efficiency by taking advantage of high-level, extensive curriculum and affordable packages. From courses designed for professionals just beginning their careers in electronic examinations to those classes focused on helping investigative experts enhance their knowledge, Guidance Software Training offers the perfect curriculum choices. Couple the courseware to any one of the purchasing packages, and every organization can ensure that their staff is fully prepared to tackle even the most challenging tasks. Structured management, budgeting, and reduction of training expenses Qualify for CPE credits on all classroom courses Attendance at all courses, including EnCase Training OnDemand, qualifies for training hours earned towards EnCE certification or renewal Train in one of our state-of-the-art facilities, at one of our Authorized Training Partners throughout the world, or our EnCE-certified instructors can come to you Customize a course to suit your organization s needs Enroll in one of our online courses with EnCase Training OnDemand Enhance professional standing by participating in one or both of our certification programs: the EnCase Certified Examiner (EnCE) or EnCase Certified ediscovery Practitioner (EnCEP )

3 Training Courses Forensic Series Digital Media Acquisition and Triage This hands-on course involves practical exercises and real-life simulations. This class provides an understanding of how to identify, triage, seize, search, and collect digital evidence from a variety of media, including desktops, laptops, and smartphones. Participants will learn how to acquire digital evidence utilizing both software and hardware acquisition tools and employ EnCase Portable to search and collect digital evidence. IT professionals, litigation support, and investigators responsible for the identification, seizure, and acquisition of digital evidence. Participants may have minimal computer skills. EnCase Computer Forensics I This hands-on course involves practical exercises and real-life simulations. The class provides participants with an understanding of the proper handling of digital evidence from the initial seizure of the computer and/or media to acquisition, and then progresses to the analysis of the data. It concludes with archiving and validating the data. IT security professionals, litigation support, and forensic investigators. Participants may have minimal computer skills and may be new to the field of computer forensics. EnCase Computer Forensics II This course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the EnCase Forensic software. This course builds upon the skills covered in the EnCase Computer Forensics I course and enhances the examiner s ability to work efficiently through the use of the unique features of EnCase software. IT security professionals, litigation support, and forensic investigators. Participants should have attended the EnCase Computer Forensics I course. EnCase Forensic v7 Transition The class is designed to assist those current EnCase Forensic users who have previously attended the EnCase Computer Forensics II course and are interested in transitioning to EnCase Forensic v7. The class provides participants with an understanding of the new EnCase Forensic v7 interface and the differences between version 7 and previous versions of EnCase Forensic. IT security professionals, litigation support, and forensic investigators. I have found Guidance Software s EnCase and training programs to be in-depth, comprehensive, and reflective of real-world issues facing law enforcement and computer forensics professionals today. We (Schaumburg Police) have successfully investigated, cleared, and/or prosecuted many suspects using their products and methodology learned from their training courses. Who Benefits from EnCase? -Detective Chris Nowicki, Investigations Division, Schaumburg Police Department Case Developers Computer Forensic Examiners Prosecutors Child Exploitation Units Fraud Examiners Language Specialists White Collar Crimes Units Sex Crimes Units Robbery/Homicide Units Gang Units Missing Persons Units Homeland Security Narcotics/Vice Units Legal Units EnCase Advanced Computer Forensics This course is designed for examiners with advanced computer skills and two or more years of experience working in the field of computer forensics. Participants learn advanced data recovery techniques of artifacts in many of the file systems supported by EnCase software. Emphasis is placed on file system artifacts. Law enforcement officers, computer forensic examiners, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics is required. The class curriculum builds upon the foundation of the EnCase Computer Forensics II course, continuing with a focus on file system examinations.

4 GUIDANCE SOFTWARE Training Training Options In-depth professional development... flexible options. Guidance Software has created multiple training options to help ensure your team remains upto-date and certified on the most current practices in digital investigations. EnCase Mobile Training Courses If your organization needs EnCase training, but does not have a computer training laboratory or a travel budget, this program has been designed for you. Guidance Software will bring all the necessary equipment and materials to your site and our instructor will conduct the course. Students will receive the same high-quality instruction as they would at a Guidance Software training facility. For a complete list of mobile options and detailed pricing call Guidance SoftwareTraining at (626) or visit our website at: EnCase Annual Training Passport Organizations must ensure that their investigative staff is properly trained to handle the continually evolving landscape of computer investigations. Budget burdens and scheduling conflicts may limit the amount of training your staff receives. The Guidance Software Annual Training Passport allows you to pay one discounted, annual and reneweable flat rate for unlimited training for your staff at any of our Guidance Software-owned facilities. Details, terms, conditions and upgrade options can be viewed at: Enterprise Series EnCase Enterprise Examinations This hands-on course focuses on the use of EnCase Enterprise to conduct investigations in a live network environment. The course provides students with administration and advanced-use EnCase Enterprise techniques. Students will learn how to use EnCase Enterprise to address internal investigations, electronic discovery, and audits in a manner consistent with recognized standards. They will also learn to integrate EnCase Enterprise with intrusion detection systems. Law enforcement professionals, senior corporate security professionals, auditors, legal professionals, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics is required. The class curriculum builds upon the foundation of the EnCase Computer Forensics II, continuing with a focus on the use of Enterprise for live, enterprise-wide investigations. EnCase ediscovery Training This hands-on course addresses the rapidly increasing need for electronic discovery in the corporate arena. Students will learn the components of the e-discovery process, and how the process scales to address small cases to enterprise-wide discovery. Using EnCase ediscovery, students will learn how to ensure an accurate e-discovery process while drastically reducing the time and financial impact currently associated with the process. Anyone who would like to substantially impact the cost and efficiency of their organization s ediscovery process. Students should either own EnCase Enterprise or EnCase ediscovery or be exploring the purchase of these products. While this course covers certain aspects of electronic discovery that are independent of EnCase software, this course is intended to show students how the Guidance Software tools can enhance the process. EnCase Cybersecurity and Analytics Training This hands-on course is designed to instruct computer investigation and information security professionals incident analysis and response, data risk mitigation, and data policy compliance techniques, using the Guidance Software EnCase Cybersecurity and EnCase Analytics solutions. The techniques taught in this course enable students to greatly reduce the risk, cost, and time associated with exposing and recovering from threats designed to evade layered security solutions, and the importance of identifying and securing sensitive data. Corporate and government/law enforcement investigators and network security personnel. Incident response supervisors and team members are encouraged to attend as are individuals working in a data audit, policy enforcement or network intrusion investigation role. Participants should have attended the EnCase Enterprise Examinations course.

5 Expert Series EnCase Advanced Internet Examinations files and the Internet are cornerstones of consumer and business computer use. Virtually all computer forensic examinations will involve analysis of and Internet artifacts, underscoring the need to understand the relevance of Internet- and -based evidence recovered during examinations. This hands-on course involves practical exercises and real-life simulations, focusing on the forensic evidence located on the computer belonging to the suspect and/or victim. Students will learn how to interpret Internet browser history, search engines, logs and correctly rebuild web pages. Corporate and government/law enforcement investigators, legal professionals, and network security personnel. Incident response supervisors and team members are encouraged to attend as are individuals working in a penetration testing or network intrusion investigation role. An understanding of the concepts of computer forensics and familiarity with EnCase Forensic software is required. Class curriculum is designed to provide a good overview of Internet usage investigation issues, both from a forensic and intruder perspective. Host Intrusion Methodology and Investigation This hands-on course is designed for investigators who want to learn more about network intrusions, the tools commonly used by attackers, and the forensic artifacts left behind. This course goes into not only the technical aspects of network intrusions, but also discusses the methodology commonly used by attackers. The course begins with an overview of networking protocols, and then addresses topics, such as session hijacking, capturing network traffic and the importance of collecting volatile data, which can contain significant forensic artifacts. Corporate and government and/or law enforcement investigators, legal professionals, and network security personnel. Incident response supervisors and team members are encouraged to attend, as are individuals working in a penetration testing or network intrusion investigation role. An understanding of the concepts of computer forensics and familiarity with EnCase Forensic software is required. Knowledge of computer networking hardware, protocols and concepts is helpful but not required. Class curriculum is designed to provide a good overview of network security and intrusion investigation issues, both from a forensic and intruder perspective. EnCase Examination of NTFS This hands-on course involves technical information and practical exercises related to the NT File System (NTFS). The class addresses the technical issues of NTFS, including an in-depth analysis of the Master File Table (MFT) and its components. Students will locate and recover NTFS artifacts from the MFT and understand their evidentiary value. The course will delve into the NT Registry files for data identifying the computer user, installed applications, and customized configurations. Students will recover encrypted passwords, identify alternate data streams, reparse points and mapped drives, identify security permissions for users, and determine if removable media was connected to an NTFS volume. In addition students will examine partially wiped drives and recover files from partially wiped NTFS volumes. The meaning and relevance of the artifacts that administratively document NTFS are emphasized. Law enforcement officers, computer forensic examiners, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics and Internet-related access is required. The class curriculum builds upon the foundation of the EnCase Computer Forensics II course, continuing with a focus on NTFS examinations. Training Options (continued) EnCase Guidance Software Training Option Program (GTO) Take advantage of maximum flexibility in scheduling and course selection. Organizations must constantly train investigative personnel to maintain the broad-based, changing skill set required for today s digital investigations. With increasing caseloads, personnel changes, and unpredictable schedules, meeting this obligation can prove challenging. Guidance Software has developed solutions that address these challenges at a practical price. Purchase five or more training seats at a reduced rate, and use those training seats in the way that best suits your needs. Seats may be used for any Guidance Software Training course, including EnCase Training OnDemand, and may be used at any of our Guidance Software-owned training facilities as well as our Authorized Training Partner, CyberEvidence. Visit the website below for complete and up-to-date program details: Incident handlers need to stay current with new forensic technologies, techniques, and procedures. -NIST Special Publication Guide to Integrating Forensic Techniques into Incident Response

6 GUIDANCE SOFTWARE Training Expert Series (continued) EnScript Programming This hands-on course is designed for students who wish to learn new programming techniques and how to apply them in a new language using real-life, meaningful investigations. Reinforcing programming logic and common statements, the class focuses on simple EnScript programs and programming techniques while identifying the different data types, operators, program control statements, and data access methods used within EnScript modules. Instructors and students will write EnScript programs together followed by practice and practical exercises. Students will leave with the ability to write simple to intermediatelevel EnScript modules to automate activities involving examinations of computer systems. Investigators with minimal to intermediate computer skills. A basic understanding of the concepts of computer forensics and the EnCase operating environment is required. The class curriculum builds upon the foundation of the EnCase Advanced Computer Forensics or EnCase Enterprise Examinations courses, continuing with a focus on automating computer examinations through writing EnScript programs. Advanced programmers may consider taking this course to acclimate themselves with the EnScript programming interface as well as learning some valuable EnScript programming tips and tricks. EnCase Examinations of Macintosh Operating Systems The introduction of the ipod, iphone, and ipad and the use of Intel-based processors have generated a steep increase in the sales of Macintosh computers, which are no longer restricted to the realm of desktop publishing and computer-aided design. Computer users are attracted by the design of the Macintosh, its UNIX-like stability, ease of use, and its ability to run Microsoft Windows. This Expert Series course makes a departure from the world of Microsoft Windows. Until I attended Guidance Software s training classes, I never realized the full potential of the software. -Sergeant Bill Lerch, Chicago Police Department OnDemand Courses Currently Available: EnCase Fundamentals EnCase Computer Forensics I EnCase Computer Forensics II EnCase Forensic v7 Transition EnCase ediscovery Fundamentals EnCase Cybersecurity Fundamentals EnCase users working as law enforcement officers, computer forensic examiners, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics is required. The class curriculum builds upon the foundation of the EnCase Computer Forensics II course, continuing with a focus on examinations of the Macintosh operating systems. EnCase Training OnDemand To help these organizations maximize their use of EnCase products, Guidance Software provides access to its world-class courses online with EnCase Training OnDemand. EnCase Training OnDemand is designed specifically for professionals in law enforcement, IT, legal departments, and government agencies who need to remain onsite due to investigation pressures, budget cuts, or staffing concerns, but also need to prepare to provide credible testimonies for digital investigations. With EnCase Training OnDemand, investigators can receive the critical training they need to do their jobs effectively, from anywhere in the world at their own convenience. EnCase Training OnDemand offers the exact same level of course training currently available at Guidance Software training facilities, and qualify for earned training hours toward participation in the EnCase Certified Examiner (EnCE ) program. All exercises, lectures, quizzes, and exams are presented online in guided, interactive tutorials and streaming video presentations.

7 Certification Guidance Software offers certification programs for private and public sector professionals in the use of EnCase digital investigation software and their proficiency in industry best practices. Since 2001, Guidance Software has certified over 4,600 computer forensic investigative professionals with the industry standard EnCase Certified Examiner (EnCE) designation. The EnCase Certified ediscovery Practitioner (EnCEP) program likewise enables e-discovery practitioners to demonstrate their skills, training, and experience in the proper handling of electronically stored information for legal purposes. Established in 2009, there are now more than 125 EnCEP certificate holders. Certification candidates must meet professional requirements and pass a rigorous testing program to earn an EnCase certification. The certifications are valid for three years, and require continuing education for renewal. Applications and detailed explanations can be found at: EnCase Certified Examiner (EnCE) Prep Course NOTE: The EnCE Application must be completed and approved before registration for this course will be confirmed. A copy of the application can be downloaded from This hands-on course is designed for EnCase users who are preparing for the EnCE (EnCase Certified Examiner) certification process. The EnCE certification is a highly soughtafter accreditation, which requires significant knowledge of computer forensics and The Guidance Software EnCase product to successfully achieve. The two-phase testing process is based on a written examination and also the completion of a thorough practical scenario examination and preparation of an investigative report. The certification is based upon the practical computer forensic skills and knowledge presented in the Guidance Software EnCase Computer Forensic I and II courses. The EnCE Prep course is not intended to be a replacement for these two classes. Instead it is a thorough but accelerated review of the subjects covered in those courses. Students cannot waive or substitute the prerequisite attendance of the Guidance Software EnCase Computer Forensics II course when applying to attend the EnCE Prep course. During this course students will use EnCase software to review the skills required to address the EnCE practical examination. Students will review the body of knowledge required to perform computer forensics, including: Computer science Computer forensic terminology Law and familiarity with the EnCase forensic tool, which is the core of the first phase (written examination) of the certification process On the final afternoon of the course, the EnCE written examination will be administered to the students in a monitored, timed environment. The results of the written examination will be provided in the week following the examination at which time those who achieved a passing score of 80% or more will also receive their practical examination. Certifying Organizations International Information Systems Security Consortium, Inc (ISC) 2 National Association of State Boards of Accountancy (NASBA) Association of Certified Fraud Examiners (ACFE) High Tech Crime Network - Guidance Software The State Bar of California, Office of Certification Texas Commission on Law Enforcement EnCE Certification EnCEP Certification EnCE Certification Bootcamp The bundle provides all required training and test preparation for EnCE certification. Students participating in this bootcamp take advantage of three courses: the EnCase OnDemand Computer Forensics I, EnCase OnDemand Computer Forensics II, and the EnCase EnCE Prep course, which is taken in the classroom. On the final afternoon of the EnCE Prep course, the EnCE written examination will be administered to the students in a monitored, timed environment. Fees and restrictions are subject to change. For the most up-to-date information on any of our courses or programs, contact Guidance Software Training at training@encase.com or (626)

8 Guidance Software Training Facilities Los Angeles, CA (Pasadena) 1055 East Colorado Boulevard, Suite 400 Pasadena, CA Washington, DC (Dulles, VA) Atlantic Boulevard, Suite 750 Dulles, VA Chicago, IL (Rosemont) 9450 West Bryn Mawr Avenue, Suite 200 Rosemont, IL Houston, TX 1300 Post Oak Boulevard, Suite 550 Houston, TX Orlando, FL 5950 Hazeltine National Drive, Suite 620 Orlando, FL London, UK (Slough) Thames Central, 5th Floor, Hatfield Road Slough, Berkshire UK SL1 1QE We also have many Authorized Training Partners all over the world and a complete list can be found at: For more information on any of our courses or programs, contact Guidance Software Training at training@encase.com or (626) Or, visit the Guidance Software website at for up-to-date details and a complete list of courses. Our Customers Guidance Software s customers are corporations and government agencies in a wide variety of industries, such as financial and insurance services, technology, defense contracting, pharmaceutical, manufacturing and retail. Representative customers include Allstate, Chevron, FBI, Ford, General Electric, Honeywell, NATO, Northrop Grumman, Pfizer, SEC, UnitedHealth Group and Viacom. About Guidance Software (NASDAQ: GUID) Guidance Software is recognized worldwide as the industry leader in digital investigative solutions. Its EnCase Enterprise platform is used by numerous government agencies, more than 65 percent of the Fortune 100, and more than 40 percent of the Fortune 500, to conduct digital investigations of servers, laptops, desktops and mobile devices. Built on the EnCase Enterprise platform are market-leading electronic discovery and cyber security solutions, EnCase ediscovery, EnCase Cybersecurity, and EnCase Analytics, which empower organizations to respond to litigation discovery requests, perform sensitive data discovery for compliance purposes, conduct speedy and thorough security incident response, and reveal previously hidden advanced persistent threats or malicious insider activity. For more information about Guidance Software, visit EnCase, EnScript, FastBloc, EnCE, EnCEP, Guidance Software and Tableau are registered trademarks or trademarks owned by Guidance Software in the United States and other jurisdictions and may not be used without prior written permission. All other trademarks and copyrights referenced in this press release are the property of their respective owners.