EnCase Computer Forensics -- The Official EnCE
Home > Computing and Information Technology > Computer certification > EnCase Computer Forensics -- The Official EnCE: EnCase Certified Examiner Study Guide
EnCase Computer Forensics -- The Official EnCE: EnCase Certified Examiner Study Guide

EnCase Computer Forensics -- The Official EnCE: EnCase Certified Examiner Study Guide


     0     
5
4
3
2
1



Out of Stock


Notify me when this book is in stock
X
About the Book

The official, Guidance Software-approved book on the newest EnCE exam! The EnCE exam tests that computer forensic analysts and examiners have thoroughly mastered computer investigation methodologies, as well as the use of Guidance Software's EnCase Forensic 7. The only official Guidance-endorsed study guide on the topic, this book prepares you for the exam with extensive coverage of all exam topics, real-world scenarios, hands-on exercises, up-to-date legal information, and sample evidence files, flashcards, and more. Guides readers through preparation for the newest EnCase Certified Examiner (EnCE) exam Prepares candidates for both Phase 1 and Phase 2 of the exam, as well as for practical use of the certification Covers identifying and searching hardware and files systems, handling evidence on the scene, and acquiring digital evidence using EnCase Forensic 7 Includes hands-on exercises, practice questions, and up-to-date legal information Sample evidence files, Sybex Test Engine, electronic flashcards, and more If you're preparing for the new EnCE exam, this is the study guide you need.

Table of Contents:
Introduction xxi Assessment Test xxvii Chapter 1 Computer Hardware 1 Computer Hardware Components 2 The Boot Process 14 Partitions 20 File Systems 25 Summary 27 Exam Essentials 27 Review Questions 28 Chapter 2 File Systems 33 FAT Basics 34 The Physical Layout of FAT 36 Viewing Directory Entries Using EnCase 52 The Function of FAT 58 NTFS Basics 73 CD File Systems 77 exFAT 79 Summary 83 Exam Essentials 84 Review Questions 85 Chapter 3 First Response 89 Planning and Preparation 90 The Physical Location 91 Personnel 91 Computer Systems 92 What to Take with You Before You Leave 94 Search Authority 97 Handling Evidence at the Scene 98 Securing the Scene 98 Recording and Photographing the Scene 99 Seizing Computer Evidence 99 Bagging and Tagging 110 Summary 113 Exam Essentials 113 Review Questions 115 Chapter 4 Acquiring Digital Evidence 119 Creating EnCase Forensic Boot Disks 121 Booting a Computer Using the EnCase Boot Disk 124 Seeing Invisible HPA and DCO Data 125 Other Reasons for Using a DOS Boot 126 Steps for Using a DOS Boot 126 Drive-to-Drive DOS Acquisition 128 Steps for Drive-to-Drive DOS Acquisition 128 Supplemental Information About Drive-to-Drive DOS Acquisition 132 Network Acquisitions 135 Reasons to Use Network Acquisitions 135 Understanding Network Cables 136 Preparing an EnCase Network Boot Disk 137 Preparing an EnCase Network Boot CD 138 Steps for Network Acquisition 138 FastBloc/Tableau Acquisitions 151 Available FastBloc Models 151 FastBloc 2 Features 152 Steps for Tableau (FastBloc) Acquisition 154 FastBloc SE Acquisitions 163 About FastBloc SE 163 Steps for FastBloc SE Acquisitions 164 LinEn Acquisitions 168 Mounting a File System as Read-Only 168 Updating a Linux Boot CD with the Latest Version of LinEn 169 Running LinEn 171 Steps for LinEn Acquisition 173 Enterprise and FIM Acquisitions 176 EnCase Portable 180 Helpful Hints 188 Summary 189 Exam Essentials 192 Review Questions 194 Chapter 5 EnCase Concepts 199 EnCase Evidence File Format 200 CRC, MD5, and SHA-1 201 Evidence File Components and Function 202 New Evidence File Format 206 Evidence File Verification 207 Hashing Disks and Volumes 215 EnCase Case Files 217 EnCase Backup Utility 220 EnCase Configuration Files 227 Evidence Cache Folder 231 Summary 233 Exam Essentials 235 Review Questions 236 Chapter 6 EnCase Environment 241 Home Screen 242 EnCase Layout 246 Creating a Case 249 Tree Pane Navigation 255 Table Pane Navigation 266 Table View 266 Gallery View 275 Timeline View 277 Disk View 280 View Pane Navigation 284 Text View 284 Hex View 287 Picture View 288 Report View 289 Doc View 289 Transcript View 290 File Extents View 291 Permissions View 291 Decode View 292 Field View 294 Lock Option 294 Dixon Box 294 Navigation Data (GPS) 295 Find Feature 297 Other Views and Tools 298 Conditions and Filters 298 EnScript 299 Text Styles 299 Adjusting Panes 300 Other Views 306 Global Views and Settings 306 EnCase Options 310 Summary 318 Exam Essentials 320 Review Questions 321 Chapter 7 Understanding, Searching For, and Bookmarking Data 325 Understanding Data 327 Binary Numbers 327 Hexadecimal 333 Characters 336 ASCII 337 Unicode 338 EnCase Evidence Processor 340 Searching for Data 352 Creating Keywords 353 GREP Keywords 364 Starting a Search 373 Viewing Search Hits and Bookmarking Your Findings 376 Bookmarking 377 Summary 426 Exam Essentials 428 Review Questions 430 Chapter 8 File Signature Analysis and Hash Analysis 435 File Signature Analysis 436 Understanding Application Binding 437 Creating a New File Signature 438 Conducting a File Signature Analysis 442 Hash Analysis 449 MD5 Hash 449 Hash Sets and Hash Libraries 449 Hash Analysis 462 Summary 466 Exam Essentials 468 Review Questions 469 Chapter 9 Windows Operating System Artifacts 473 Dates and Times 475 Time Zones 475 Windows 64-Bit Time Stamp 476 Adjusting for Time Zone Offsets 481 Recycle Bin 487 Details of Recycle Bin Operation 488 The INFO2 File 488 Determining the Owner of Files in the Recycle Bin 493 Files Restored or Deleted from the Recycle Bin 494 Using an EnCase Evidence Processor to Determine the Status of Recycle Bin Files 496 Recycle Bin Bypass 498 Windows Vista/Windows 7 Recycle Bin 500 Link Files 504 Changing the Properties of a Shortcut 504 Forensic Importance of Link Files 505 Using the Link File Parser 509 Windows Folders 511 Recent Folder 515 Desktop Folder 516 My Documents/Documents 518 Send To Folder 518 Temp Folder 519 Favorites Folder 520 Windows Vista Low Folders 521 Cookies Folder 523 History Folder 526 Temporary Internet Files 532 Swap File 535 Hibernation File 536 Print Spooling 537 Legacy Operating System Artifacts 543 Windows Volume Shadow Copy 544 Windows Event Logs 549 Kinds of Information Available in Event Logs 549 Determining Levels of Auditing 552 Windows Vista/7 Event Logs 554 Using the Windows Event Log Parser 555 For More Information 558 Summary 559 Exam Essentials 564 Review Questions 566 Chapter 10 Advanced EnCase 571 Locating and Mounting Partitions 573 Mounting Files 588 Registry 595 Registry History 595 Registry Organization and Terminology 596 Using EnCase to Mount and View the Registry 601 Registry Research Techniques 605 EnScript and Filters 608 Running EnScripts 609 Filters and Conditions 611 Email 614 Base64 Encoding 619 EnCase Decryption Suite 622 Virtual File System (VFS) 629 Restoration 633 Physical Disk Emulator (PDE) 636 Putting It All Together 641 Summary 645 Exam Essentials 648 Review Questions 649 Appendix A Answers to Review Questions 653 Chapter 1: Computer Hardware 654 Chapter 2: File Systems 655 Chapter 3: First Response 657 Chapter 4: Acquiring Digital Evidence 658 Chapter 5: EnCase Concepts 659 Chapter 6: EnCase Environment 661 Chapter 7: Understanding, Searching For, and Bookmarking Data 662 Chapter 8: File Signature Analysis and Hash Analysis 663 Chapter 9: Windows Operating System Artifacts 664 Chapter 10: Advanced EnCase 665 Appendix B Creating Paperless Reports 667 Exporting the Web Page Report 669 Creating Your Container Report 671 Bookmarks and Hyperlinks 675 Burning the Report to CD or DVD 678 Appendix C About the Additional Study Tools 681 Additional Study Tools 682 Sybex Test Engine 682 Electronic Flashcards 682 PDF of Glossary of Terms 682 Adobe Reader 682 Additional Author Files 683 System Requirements 683 Using the Study Tools 683 Troubleshooting 683 Customer Care 684 Index 685  

About the Author :
Steve Bunting, EnCE, CCFT, has over 30 years of law enforcement and computer forensics experience. He is a Senior Forensic Consultant for Forward Discovery, a global forensics consulting organization. Previously he served as a captain with the University of Delaware Police Department, where he conducted examinations of computer systems for federal, state, and local law enforcement. He is also the coauthor of Mastering Windows Network Forensics and Investigation.


Best Sellers


Product Details
  • ISBN-13: 9781118219423
  • Publisher: John Wiley & Sons Inc
  • Publisher Imprint: Sybex Inc.,U.S.
  • Edition: Revised edition
  • No of Pages: 752
  • ISBN-10: 1118219422
  • Publisher Date: 14 Sep 2012
  • Binding: Digital (delivered electronically)
  • Language: English
  • Sub Title: EnCase Certified Examiner Study Guide


Similar Products

Add Photo
Add Photo

Customer Reviews

REVIEWS      0     
Click Here To Be The First to Review this Product
EnCase Computer Forensics -- The Official EnCE: EnCase Certified Examiner Study Guide
John Wiley & Sons Inc -
EnCase Computer Forensics -- The Official EnCE: EnCase Certified Examiner Study Guide
Writing guidlines
We want to publish your review, so please:
  • keep your review on the product. Review's that defame author's character will be rejected.
  • Keep your review focused on the product.
  • Avoid writing about customer service. contact us instead if you have issue requiring immediate attention.
  • Refrain from mentioning competitors or the specific price you paid for the product.
  • Do not include any personally identifiable information, such as full names.

EnCase Computer Forensics -- The Official EnCE: EnCase Certified Examiner Study Guide

Required fields are marked with *

Review Title*
Review
    Add Photo Add up to 6 photos
    Would you recommend this product to a friend?
    Tag this Book Read more
    Does your review contain spoilers?
    What type of reader best describes you?
    I agree to the terms & conditions
    You may receive emails regarding this submission. Any emails will include the ability to opt-out of future communications.

    CUSTOMER RATINGS AND REVIEWS AND QUESTIONS AND ANSWERS TERMS OF USE

    These Terms of Use govern your conduct associated with the Customer Ratings and Reviews and/or Questions and Answers service offered by Bookswagon (the "CRR Service").


    By submitting any content to Bookswagon, you guarantee that:
    • You are the sole author and owner of the intellectual property rights in the content;
    • All "moral rights" that you may have in such content have been voluntarily waived by you;
    • All content that you post is accurate;
    • You are at least 13 years old;
    • Use of the content you supply does not violate these Terms of Use and will not cause injury to any person or entity.
    You further agree that you may not submit any content:
    • That is known by you to be false, inaccurate or misleading;
    • That infringes any third party's copyright, patent, trademark, trade secret or other proprietary rights or rights of publicity or privacy;
    • That violates any law, statute, ordinance or regulation (including, but not limited to, those governing, consumer protection, unfair competition, anti-discrimination or false advertising);
    • That is, or may reasonably be considered to be, defamatory, libelous, hateful, racially or religiously biased or offensive, unlawfully threatening or unlawfully harassing to any individual, partnership or corporation;
    • For which you were compensated or granted any consideration by any unapproved third party;
    • That includes any information that references other websites, addresses, email addresses, contact information or phone numbers;
    • That contains any computer viruses, worms or other potentially damaging computer programs or files.
    You agree to indemnify and hold Bookswagon (and its officers, directors, agents, subsidiaries, joint ventures, employees and third-party service providers, including but not limited to Bazaarvoice, Inc.), harmless from all claims, demands, and damages (actual and consequential) of every kind and nature, known and unknown including reasonable attorneys' fees, arising out of a breach of your representations and warranties set forth above, or your violation of any law or the rights of a third party.


    For any content that you submit, you grant Bookswagon a perpetual, irrevocable, royalty-free, transferable right and license to use, copy, modify, delete in its entirety, adapt, publish, translate, create derivative works from and/or sell, transfer, and/or distribute such content and/or incorporate such content into any form, medium or technology throughout the world without compensation to you. Additionally,  Bookswagon may transfer or share any personal information that you submit with its third-party service providers, including but not limited to Bazaarvoice, Inc. in accordance with  Privacy Policy


    All content that you submit may be used at Bookswagon's sole discretion. Bookswagon reserves the right to change, condense, withhold publication, remove or delete any content on Bookswagon's website that Bookswagon deems, in its sole discretion, to violate the content guidelines or any other provision of these Terms of Use.  Bookswagon does not guarantee that you will have any recourse through Bookswagon to edit or delete any content you have submitted. Ratings and written comments are generally posted within two to four business days. However, Bookswagon reserves the right to remove or to refuse to post any submission to the extent authorized by law. You acknowledge that you, not Bookswagon, are responsible for the contents of your submission. None of the content that you submit shall be subject to any obligation of confidence on the part of Bookswagon, its agents, subsidiaries, affiliates, partners or third party service providers (including but not limited to Bazaarvoice, Inc.)and their respective directors, officers and employees.

    Accept

    New Arrivals


    Inspired by your browsing history


    Your review has been submitted!

    You've already reviewed this product!