Course Curriculum

    1. Introduction to File and Data Carving - Slides

    1. Parsing MFT

    2. Using FTK Imager

    1. Required Files

    2. Case #1 Brief

    3. Case #1 How Was Mr. Wayne Killed - Solution

    1. Required Files

    2. Case #2 - Brief

    3. Case #2 Investigating A Formatted Drive

    1. Required Files

    2. Case #3 - Brief

    3. Case #3 Investigating Hidden Data and File Carving

    1. Required Files

    2. Case #4 - Brief

    3. Case #4 Wiped Drive

About this course

  • $50.00
  • 22 lessons
  • 0 hours of video content

8 CPE Credits

After completing this course, you will earn:

Learning Outcomes

After completing this course, you will learn the following.

  • Ability to retrieve data from formatted, corrupted and unallocated storage spaces

  • Ability to use various tools to extract and carve files from data sources

  • Recover important artifacts related to an investigation

  • Learn howto use recovered evidence to be correlated with other existing data used for an investigation

Technical Requirements

To complete the hands-on labs of this track

  • Windows 10/11 operating system (recommended)

  • Internet Connection

  • 010 Editor here or HxD Editor here

  • X-Ways here or WinHex here

  • PhotoRec here or Foremost here

What is next at Cyber 5W?

Add your email to the mailing list to get the latest updates.

Thank You