Course Curriculum

  • 01

    File and Data Carving

    • Required Files

    • Introduction to File and Data Carving - Slides

    • Introduction to Data Carving

    • Manual Data Carving - Using Hex Editor

    • Manual Data Carving - Carving an Image from a Doc File

    • Automatic Data Carving - Photorec

    • Automatic Data Carving - Foremost

    • Required Files

    • Exercise #1

    • Exercise #1 - Solution

    • Exercise #2

    • Exercise #2 - Solution

    • Exercise #3

    • Exercise #3 - Solution
  • 02

    Resources

    • Extra Reading Resources

Learning Outcomes

After completing this course, you will learn the following.

  • Ability to retrieve data from formatted, corrupted and unallocated storage spaces

  • Ability to use various tools to extract and carve files from data sources

  • Recover important artifacts related to an investigation

  • Learn howto use recovered evidence to be correlated with other existing data used for an investigation

Technical Requirements

To complete the hands-on labs of this track

  • Windows 10/11 operating system (recommended)

  • Internet Connection

  • 010 Editor here or HxD Editor here

  • X-Ways here or WinHex here

  • PhotoRec here or Foremost here

What is next at Cyber 5W?

Add your email to the mailing list to get the latest updates.