GUIDANCE SOFTWARE
|
Training
Guidance Software Training
Real-world Experience with Guidance Software Training
GUIDANCE SOFTWARE
|
Training
Guidance Software Training
Who Benefits
from Training?
•All EnCase software users from
the novice to the seasoned
professional
•All government agencies and
private organizations that are
responsible for analysis of
electronic media
The digital investigations training
specialists at Guidance Software
have trained more than 60,000
students.
“We at the Schaumburg (Illinois)
Police Department strive to be at
the forefront of law enforcement,
and Guidance Software’s EnCase
products and training programs
are a part of that effort. From
cutting-edge training courses to
flexible training options such as
the Training Annual Passport,
we’ve found Guidance Software
to be at the top of their game and
their products, training programs
and certifications—such as the
EnCase Certified Examiner (EnCE)
becoming the industry standard.”
-Commander Dawn McDermott,
Investigations Division Commander,
Schaumburg Police Department
Corporations and government agencies use EnCase software to search, collect, preserve,
and analyze digital information for the purposes of computer forensics investigations,
information assurance, e-discovery collection, data loss prevention, compliance with
mandated regulations and more. Guidance Software Training courses and programs help
organizations maximize their use of EnCase products.
The best training available on critical, real-world issues
Guidance Software offers world-class training in enterprise investigations, such as
e-discovery and computer security incident response, and forensic investigations, including
law enforcement and fraud investigations.
Stay ahead of the curve
Whether you want to learn state-of-the-art practices in digital forensics or get up to
speed with the most advanced technology available, EnCase training from Guidance
Software is the standard across all industries. After training more than 60,000 investigative
professionals, no one can deliver more focused, tactical, and expert knowledge about
EnCase and digital investigations as a practice. Learn the latest technology and techniques
and advance your career with Guidance Software Training.
As the volume and sophistication of digital investigations continue to increase, investigators
can stay ahead of the curve and maintain departmental efficiency by taking advantage
of high-level, extensive curriculum and affordable packages. From courses designed for
professionals just beginning their careers in electronic examinations to those classes
focused on helping investigative experts enhance their knowledge, Guidance Software
Training offers the perfect curriculum choices. Couple the courseware to any one of the
purchasing packages, and every organization can ensure that their staff is fully prepared to
tackle even the most challenging tasks.
n
Structured management, budgeting, and reduction of training expenses
n
Qualify for CPE credits on all classroom courses
n
Attendance at all courses, including EnCase Training OnDemand, qualifies for
training hours earned towards EnCE® certification or renewal
n
Train in one of our state-of-the-art facilities, at one of our Authorized Training
Partners throughout the world, or our EnCE-certified instructors can come to you
n
Customize a course to suit your organization’s needs
n
Enroll in one of our online courses with EnCase Training OnDemand
n
Enhance professional standing by participating in one or both of our certification
programs: the EnCase Certified Examiner (EnCE) or EnCase Certified eDiscovery
Practitioner (EnCEP®)
www.encase.com/computer-forensics-training-certifications.htm
Training Courses
Forensic Series
Digital Media Acquisition and Triage
This hands-on course involves practical exercises and real-life simulations. This class
provides an understanding of how to identify, triage, seize, search, and collect digital
evidence from a variety of media, including desktops, laptops, and smartphones. Participants
will learn how to acquire digital evidence utilizing both software and hardware acquisition
tools and employ EnCase Portable to search and collect digital evidence.
Who should attend?
IT professionals, litigation support, and investigators responsible for the identification,
seizure, and acquisition of digital evidence. Participants may have minimal computer skills.
EnCase Computer Forensics I
This hands-on course involves practical exercises and real-life simulations. The class
provides participants with an understanding of the proper handling of digital evidence from
the initial seizure of the computer and/or media to acquisition, and then progresses to the
analysis of the data. It concludes with archiving and validating the data.
“I have found Guidance Software’s
EnCase and training programs
to be in-depth, comprehensive,
and reflective of real-world issues
facing law enforcement and
computer forensics professionals
today. We (Schaumburg Police)
have successfully investigated,
cleared, and/or prosecuted many
suspects using their products and
methodology learned from their
training courses.”
-Detective Chris Nowicki,
Investigations Division,
Schaumburg Police Department
Who should attend?
IT security professionals, litigation support, and forensic investigators. Participants may have
minimal computer skills and may be new to the field of computer forensics.
EnCase Computer Forensics II
This course is designed for investigators with strong computer skills, prior computer forensics
training, and experience using the EnCase Forensic software. This course builds upon the
skills covered in the EnCase Computer Forensics I course and enhances the examiner’s
ability to work efficiently through the use of the unique features of EnCase software.
Who should attend?
IT security professionals, litigation support, and forensic investigators. Participants should
have attended the EnCase Computer Forensics I course.
EnCase Forensic v7 Transition
The class is designed to assist those current EnCase Forensic users who have previously
attended the EnCase Computer Forensics II course and are interested in transitioning to
EnCase Forensic v7. The class provides participants with an understanding of the new
EnCase Forensic v7 interface and the differences between version 7 and previous versions
of EnCase Forensic.
Who should attend?
IT security professionals, litigation support, and forensic investigators.
EnCase Advanced Computer Forensics
This course is designed for examiners with advanced computer skills and two or more years
of experience working in the field of computer forensics. Participants learn advanced data
recovery techniques of artifacts in many of the file systems supported by EnCase software.
Emphasis is placed on file system artifacts.
Who should attend?
Law enforcement officers, computer forensic examiners, corporate and private investigators,
and network security personnel. A basic understanding of the concepts of computer forensics
is required. The class curriculum builds upon the foundation of the EnCase Computer Forensics
II course, continuing with a focus on file system examinations.
Who Benefits
from EnCase?
•Case Developers
•Computer Forensic Examiners
•Prosecutors
•Child Exploitation Units
•Fraud Examiners
•Language Specialists
•White Collar Crimes Units
•Sex Crimes Units
•Robbery/Homicide Units
•Gang Units
•Missing Persons Units
•Homeland Security
•Narcotics/Vice Units
•Legal Units
GUIDANCE SOFTWARE
|
Training
Training Options
In-depth professional
development... flexible options.
Guidance Software has created
multiple training options to help
ensure your team remains upto-date and certified on the
most current practices in digital
investigations.
EnCase Mobile Training Courses
If your organization needs EnCase
training, but does not have a
computer training laboratory or
a travel budget, this program
has been designed for you.
Guidance Software will bring all
the necessary equipment and
materials to your site and our
instructor will conduct the course.
Students will receive the same
high-quality instruction as they
would at a Guidance Software
training facility.
For a complete list of mobile
options and detailed pricing
call Guidance SoftwareTraining
at (626) 463-7966 or visit our
website at:
www.encase.com/computerforensics-training-mobile-onsite.htm
EnCase Annual Training Passport
Organizations must ensure that
their investigative staff is properly
trained to handle the continually
evolving landscape of computer
investigations. Budget burdens
and scheduling conflicts may limit
the amount of training your staff
receives. The Guidance Software
Annual Training Passport allows
you to pay one discounted,
annual and reneweable flat rate
for unlimited training for your
staff at any of our Guidance
Software-owned facilities.
Details, terms, conditions and
upgrade options can be viewed at:
www.encase.com/computerforensics-training-annual-trainingpassport.htm
Enterprise Series
EnCase Enterprise Examinations
This hands-on course focuses on the use of EnCase Enterprise to conduct investigations
in a live network environment. The course provides students with administration and
advanced-use EnCase Enterprise techniques. Students will learn how to use EnCase
Enterprise to address internal investigations, electronic discovery, and audits in a manner
consistent with recognized standards. They will also learn to integrate EnCase Enterprise
with intrusion detection systems.
Who should attend?
Law enforcement professionals, senior corporate security professionals, auditors, legal
professionals, corporate and private investigators, and network security personnel. A basic
understanding of the concepts of computer forensics is required. The class curriculum
builds upon the foundation of the EnCase Computer Forensics II, continuing with a focus on
the use of Enterprise for live, enterprise-wide investigations.
EnCase eDiscovery Training
This hands-on course addresses the rapidly increasing need for electronic discovery in the
corporate arena. Students will learn the components of the e-discovery process, and how
the process scales to address small cases to enterprise-wide discovery. Using EnCase
eDiscovery, students will learn how to ensure an accurate e-discovery process while
drastically reducing the time and financial impact currently associated with the process.
Who should attend?
Anyone who would like to substantially impact the cost and efficiency of their
organization’s eDiscovery process. Students should either own EnCase Enterprise or
EnCase eDiscovery or be exploring the purchase of these products. While this course
covers certain aspects of electronic discovery that are independent of EnCase software,
this course is intended to show students how the Guidance Software tools can enhance
the process.
EnCase Cybersecurity and Analytics Training
This hands-on course is designed to instruct computer investigation and information
security professionals’ incident analysis and response, data risk mitigation, and data
policy compliance techniques, using the Guidance Software EnCase Cybersecurity and
EnCase Analytics solutions. The techniques taught in this course enable students to
greatly reduce the risk, cost, and time associated with exposing and recovering from
threats designed to evade layered security solutions, and the importance of identifying
and securing sensitive data.
Who should attend?
Corporate and government/law enforcement investigators and network security personnel.
Incident response supervisors and team members are encouraged to attend as are
individuals working in a data audit, policy enforcement or network intrusion investigation
role. Participants should have attended the EnCase Enterprise Examinations course.
Expert Series
EnCase Advanced Internet Examinations
E-mail files and the Internet are cornerstones of consumer and business computer use.
Virtually all computer forensic examinations will involve analysis of e-mail and Internet
artifacts, underscoring the need to understand the relevance of Internet- and e-mail-based
evidence recovered during examinations. This hands-on course involves practical exercises
and real-life simulations, focusing on the forensic evidence located on the computer
belonging to the suspect and/or victim. Students will learn how to interpret Internet browser
history, search engines, logs and correctly rebuild web pages.
Who should attend?
Corporate and government/law enforcement investigators, legal professionals, and network
security personnel. Incident response supervisors and team members are encouraged to
attend as are individuals working in a penetration testing or network intrusion investigation
role. An understanding of the concepts of computer forensics and familiarity with EnCase
Forensic software is required. Class curriculum is designed to provide a good overview of
Internet usage investigation issues, both from a forensic and intruder perspective.
Host Intrusion Methodology and Investigation
This hands-on course is designed for investigators who want to learn more about network
intrusions, the tools commonly used by attackers, and the forensic artifacts left behind. This
course goes into not only the technical aspects of network intrusions, but also discusses the
methodology commonly used by attackers. The course begins with an overview of networking
protocols, and then addresses topics, such as session hijacking, capturing network traffic and
the importance of collecting volatile data, which can contain significant forensic artifacts.
Who should attend?
Corporate and government and/or law enforcement investigators, legal professionals,
and network security personnel. Incident response supervisors and team members are
encouraged to attend, as are individuals working in a penetration testing or network intrusion
investigation role. An understanding of the concepts of computer forensics and familiarity
with EnCase Forensic software is required. Knowledge of computer networking hardware,
protocols and concepts is helpful but not required. Class curriculum is designed to provide a
good overview of network security and intrusion investigation issues, both from a forensic and
intruder perspective.
EnCase Examination of NTFS
This hands-on course involves technical information and practical exercises related to the NT
File System (NTFS). The class addresses the technical issues of NTFS, including an
in-depth analysis of the Master File Table (MFT) and its components. Students will locate and
recover NTFS artifacts from the MFT and understand their evidentiary value. The course will
delve into the NT Registry files for data identifying the computer user, installed applications,
and customized configurations. Students will recover encrypted passwords, identify alternate
data streams, reparse points and mapped drives, identify security permissions for users,
and determine if removable media was connected to an NTFS volume. In addition students
will examine partially wiped drives and recover files from partially wiped NTFS volumes. The
meaning and relevance of the artifacts that administratively document NTFS are emphasized.
Who should attend?
Law enforcement officers, computer forensic examiners, corporate and private investigators,
and network security personnel. A basic understanding of the concepts of computer forensics
and Internet-related access is required. The class curriculum builds upon the foundation of the
EnCase Computer Forensics II course, continuing with a focus on NTFS examinations.
Training Options
(continued)
EnCase Guidance Software
Training Option Program (GTO)
Take advantage of maximum
flexibility in scheduling and course
selection.
Organizations must constantly train
investigative personnel to maintain
the broad-based, changing skill
set required for today’s digital
investigations. With increasing
caseloads, personnel changes,
and unpredictable schedules,
meeting this obligation can prove
challenging. Guidance Software
has developed solutions that
address these challenges at a
practical price. Purchase five or
more training seats at a reduced
rate, and use those training
seats in the way that best suits
your needs. Seats may be used
for any Guidance Software
Training course, including
EnCase Training OnDemand,
and may be used at any of our
Guidance Software-owned
training facilities as well as our
Authorized Training Partner,
CyberEvidence.
Visit the website below for
complete and up-to-date
program details:
www.encase.com/computerforensics-training-programs.htm
“Incident handlers need to
stay current with new forensic
technologies, techniques, and
procedures.”
-NIST Special
Publication 800-8
Guide to Integrating Forensic Techniques
into Incident Response
GUIDANCE SOFTWARE
|
Training
Expert Series (continued)
EnScript® Programming
This hands-on course is designed for students who wish to learn new programming
techniques and how to apply them in a new language using real-life, meaningful
investigations. Reinforcing programming logic and common statements, the class focuses on
simple EnScript programs and programming techniques while identifying the different data
types, operators, program control statements, and data access methods used within EnScript
modules. Instructors and students will write EnScript programs together followed by practice
and practical exercises. Students will leave with the ability to write simple to intermediatelevel EnScript modules to automate activities involving examinations of computer systems.
Who should attend?
Investigators with minimal to intermediate computer skills. A basic understanding of the
concepts of computer forensics and the EnCase operating environment is required. The
class curriculum builds upon the foundation of the EnCase Advanced Computer Forensics or
EnCase Enterprise Examinations courses, continuing with a focus on automating computer
examinations through writing EnScript programs. Advanced programmers may consider taking
this course to acclimate themselves with the EnScript programming interface as well as
learning some valuable EnScript programming tips and tricks.
EnCase Examinations of Macintosh Operating Systems
The introduction of the iPod, iPhone, and iPad and the use of Intel-based processors have
generated a steep increase in the sales of Macintosh computers, which are no longer
restricted to the realm of desktop publishing and computer-aided design. Computer users
are attracted by the design of the Macintosh, its UNIX-like stability, ease of use, and its
ability to run Microsoft® Windows. This Expert Series course makes a departure from the
world of Microsoft Windows.
“Until I attended Guidance
Software’s training classes, I never
realized the full potential of the
software.”
-Sergeant Bill Lerch,
Chicago Police Department
Who should attend?
EnCase users working as law enforcement officers, computer forensic examiners,
corporate and private investigators, and network security personnel. A basic understanding
of the concepts of computer forensics is required. The class curriculum builds upon the
foundation of the EnCase Computer Forensics II course, continuing with a focus on
examinations of the Macintosh operating systems.
EnCase Training OnDemand
To help these organizations maximize their use of EnCase products, Guidance Software
provides access to its world-class courses online with EnCase Training OnDemand.
OnDemand Courses
Currently Available:
EnCase Fundamentals
EnCase Computer Forensics I
EnCase Computer Forensics II
EnCase Forensic v7 Transition
EnCase eDiscovery Fundamentals
EnCase Cybersecurity
Fundamentals
EnCase Training OnDemand is designed specifically for professionals in law enforcement,
IT, legal departments, and government agencies who need to remain onsite due to
investigation pressures, budget cuts, or staffing concerns, but also need to prepare to
provide credible testimonies for digital investigations. With EnCase Training OnDemand,
investigators can receive the critical training they need to do their jobs effectively, from
anywhere in the world at their own convenience.
EnCase Training OnDemand offers the exact same level of course training currently
available at Guidance Software training facilities, and qualify for earned training hours
toward participation in the EnCase Certified Examiner (EnCE®) program. All exercises,
lectures, quizzes, and exams are presented online in guided, interactive tutorials and
streaming video presentations.
Certification
Guidance Software offers certification programs for private and public sector professionals in
the use of EnCase digital investigation software and their proficiency in industry best practices.
Since 2001, Guidance Software has certified over 4,600 computer forensic investigative
professionals with the industry standard EnCase Certified Examiner (EnCE) designation.
The EnCase Certified eDiscovery Practitioner (EnCEP) program likewise enables
e-discovery practitioners to demonstrate their skills, training, and experience in the proper
handling of electronically stored information for legal purposes. Established in 2009, there
are now more than 125 EnCEP certificate holders.
Certification candidates must meet professional requirements and pass a rigorous testing
program to earn an EnCase certification. The certifications are valid for three years, and
require continuing education for renewal.
Applications and detailed explanations can be found at:
http://www.encase.com/computer-forensics-training-ence-certification.htm
http://www.encase.com/computer-forensics-training-encep-certification.htm
EnCase Certified Examiner (EnCE) Prep Course
NOTE: The EnCE Application must be completed and approved before registration
for this course will be confirmed. A copy of the application can be downloaded
from www.encase.com/computer-forensics-training-ence-certification.htm.
This hands-on course is designed for EnCase users who are preparing for the EnCE
(EnCase Certified Examiner) certification process. The EnCE certification is a highly soughtafter accreditation, which requires significant knowledge of computer forensics and The
Guidance Software EnCase product to successfully achieve. The two-phase testing process
is based on a written examination and also the completion of a thorough practical scenario
examination and preparation of an investigative report.
The certification is based upon the practical computer forensic skills and knowledge
presented in the Guidance Software EnCase Computer Forensic I and II courses. The
EnCE Prep course is not intended to be a replacement for these two classes. Instead it is a
thorough but accelerated review of the subjects covered in those courses. Students cannot
waive or substitute the prerequisite attendance of the Guidance Software EnCase Computer
Forensics II course when applying to attend the EnCE Prep course.
During this course students will use EnCase software to review the skills required to address
the EnCE practical examination. Students will review the body of knowledge required to
perform computer forensics, including:
n
Computer science
n
Computer forensic terminology
n
Law and familiarity with the EnCase forensic tool, which is the core of the first
phase (written examination) of the certification process
On the final afternoon of the course, the EnCE written examination will be administered
to the students in a monitored, timed environment. The results of the written examination
will be provided in the week following the examination at which time those who achieved a
passing score of 80% or more will also receive their practical examination.
Certifying
Organizations
International Information
Systems Security Consortium,
Inc (ISC)2
National Association of State
Boards of Accountancy (NASBA)
Association of Certified Fraud
Examiners (ACFE)
High Tech Crime Network Guidance Software
The State Bar of California, Office
of Certification
Texas Commission on Law
Enforcement
EnCE® Certification
EnCEP® Certification
EnCE®
Certification Bootcamp
The bundle provides all required
training and test preparation
for EnCE certification. Students
participating in this bootcamp take
advantage of three courses: the
EnCase OnDemand Computer
Forensics I, EnCase OnDemand
Computer Forensics II, and the
EnCase EnCE Prep course, which
is taken in the classroom. On
the final afternoon of the EnCE
Prep course, the EnCE written
examination will be administered to
the students in a monitored, timed
environment.
Fees and restrictions are subject
to change. For the most up-to-date
information on any of our
courses or programs, contact
Guidance Software Training at
training@encase.com or
(626) 463-7966.
Guidance Software
Training Facilities
Los Angeles, CA (Pasadena)
1055 East Colorado Boulevard, Suite 400
Pasadena, CA 91106-2375
Washington, DC (Dulles, VA)
21000 Atlantic Boulevard, Suite 750
Dulles, VA 20166
Chicago, IL (Rosemont)
9450 West Bryn Mawr Avenue, Suite 200
Rosemont, IL 60018
Houston, TX
1300 Post Oak Boulevard, Suite 550
Houston, TX 77056
Orlando, FL
5950 Hazeltine National Drive, Suite 620
Orlando, FL 32822
London, UK (Slough)
Thames Central, 5th Floor, Hatfield Road
Slough, Berkshire UK SL1 1QE
We also have many Authorized Training Partners all over the
world and a complete list can be found at:
www.encase.com/computer-forensics-training-partners.htm
For more information on any of our courses or programs,
contact Guidance Software Training
at training@encase.com or (626) 463-7966.
Or, visit the Guidance Software
website at www.encase.com for up-to-date
details and a complete list of courses.
www.encase.com
Our Customers
Guidance Software’s customers are corporations and government agencies in a wide variety of industries, such as financial and insurance services, technology,
defense contracting, pharmaceutical, manufacturing and retail. Representative customers include Allstate, Chevron, FBI, Ford, General Electric, Honeywell, NATO,
Northrop Grumman, Pfizer, SEC, UnitedHealth Group and Viacom.
About Guidance Software (NASDAQ: GUID)
Guidance Software is recognized worldwide as the industry leader in digital investigative solutions. Its EnCase® Enterprise platform is used by numerous government
agencies, more than 65 percent of the Fortune 100, and more than 40 percent of the Fortune 500, to conduct digital investigations of servers, laptops, desktops
and mobile devices. Built on the EnCase Enterprise platform are market-leading electronic discovery and cyber security solutions, EnCase eDiscovery, EnCase
Cybersecurity, and EnCase Analytics, which empower organizations to respond to litigation discovery requests, perform sensitive data discovery for compliance
purposes, conduct speedy and thorough security incident response, and reveal previously hidden advanced persistent threats or malicious insider activity. For more
information about Guidance Software, visit www.encase.com.
EnCase®, EnScript®, FastBloc®, EnCE®, EnCEP®, Guidance Software™ and Tableau™ are registered trademarks or trademarks owned by Guidance Software in the United States and other jurisdictions and may not be
used without prior written permission. All other trademarks and copyrights referenced in this press release are the property of their respective owners.