Course Curriculum

  • 01

    Introduction

    • Introduction to File and Data Carving - Slides
  • 02

    Basics

    • Parsing MFT

    • Using FTK Imager
  • 03

    Case #1: Investigating ...

    • Required Files

    • Case #1 Brief

    • Case #1 How Was Mr. Wayne Killed - Solution
  • 04

    Case #2:

    • Required Files

    • Case #2 - Brief

    • Case #2 Investigating A Formatted Drive
  • 05

    Case 3

    • Required Files

    • Case #3 - Brief

    • Case #3 Investigating Hidden Data and File Carving
  • 06

    Case 4

    • Required Files

    • Case #4 - Brief

    • Case #4 Wiped Drive
  • 07

    Case 5

    • Required Files

    • Case #5 - Brief

    • Case #5 Unallocated Space
  • 08

    Case 6

    • Required Files

    • Case #6 Hidden Malware

    • Case #6 - Brief
  • 09

    Resources

    • Extra Reading Resources

8 CPE Credits

After completing this course, you will earn:

Learning Outcomes

After completing this course, you will learn the following.

  • Ability to retrieve data from formatted, corrupted and unallocated storage spaces

  • Ability to use various tools to extract and carve files from data sources

  • Recover important artifacts related to an investigation

  • Learn howto use recovered evidence to be correlated with other existing data used for an investigation

Technical Requirements

To complete the hands-on labs of this track

  • Windows 10/11 operating system (recommended)

  • Internet Connection

  • 010 Editor here or HxD Editor here

  • X-Ways here or WinHex here

  • PhotoRec here or Foremost here

What is next at Cyber 5W?

Add your email to the mailing list to get the latest updates.