WinArt Class List
Cybercop 315 - Windows Artifacts
is no tuition fee for this NW3C class for anyone actively employed with a State,
Local or Tribal Law Enforcement agency.
For any class with a duration of 2 days or
more, NW3C will charge Federal employees $750.00 per student. Agencies will
receive an invoice upon completion of the
This 4 1/2 day course introduces the student to the identification and extraction of artifacts associated with Windows operating systems (XP through Windows 8) and the NT file system. Topical areas include named data streams, reparse points, encrypted objects, and a detailed examination of various registry artifacts to include mounted devices, the user assist key, security components and user specific information. Students will also examine event logs, volume shadow copy service, and thumbnails. The artifacts will be covered in a classroom and interactive setting which includes accessing suspect images in a virtual environment.
PREREQUISITES: This course requires the student have previous training in Cybercop 101 - BDRA and Cybercop 201 - IDRA, or the equivalent and experience drawn from the application of the techniques utilized in these classes.
There is 1 WinArt class currently scheduled.
Mon, Nov 17, 2014
4 1/2 Days
1000 Calvert Street|
Fort Worth, TX 76102
Back to List