ICAC-IDRA Class List
ICAC-Cybercop 201 - Intermediate Data Recovery and Analysis
This course is funded through OJJDP. To register for this class, you must be affiliated with an ICAC Task Force. Furthermore, you must agree to comply with the Best Practices and Standards established by ICAC. If you have any questions about the ICAC Best Practices and Standards, please contact your ICAC commander.
This 3 ½ day course is designed to be the “sequel” to the Cybercop 101 - BDRA course. It consists of an introduction to the architecture and functionality of the Windows NT File System (NTFS), the FAT File System and related processing issues. Topical areas include processing the recycle bin, as well as recovering deleted files and long file names. Additional critical topics where potential evidence may be overlooked include file headers, file hashing, slack space, unallocated space, and application metadata. The class is scenario based giving an opportunity for the students to examine 4 separate “suspect” hard drives.
PREREQUISITES: This course requires the student to have
successfully completed Cybercop 101 – BDRA or the equivalent and/or have the experience drawn from the application of the techniques utilized in the Cybercop 101 - BDRA class.
There are currently no scheduled classes for this course. If you are interested in knowing when the next class might be offered
or would like more information in general please see the training contact information on this page.
Back to List