-
The
partition
table
-
The boot
record
-
Bitmaps
-
The root
directory
-
The
MFT
-
Headers
-
Attributes
-
Resident
files
-
Non-resident
files
-
Run lists,
etc.
-
Alternate
data
streams
-
File
storage
-
The various
dates and
times stored
in
attributes
-
File
deletion
-
File
recovery
-
Directory
storage
-
Tracing
files/directories
-
The NTFS
registry
"hive"
-
Examining
NTFS
drives
A practical
exercise involving
the detailed
exploration of the
NTFS logical
structures on a specially
prepared NTFS dive.
A written
examination
regarding the
material covered
in this
module.
This course
does not cover forensic issues, only the logical structures of the
NTFS file system. It is assumed that the student is already
proficient in forensic matters or merely wishes to learn about the
on-disk logical structures of the NTFS file system. If you
are unsure of your forensic proficiency,
we suggest that you take the entire
basic forensic examiner course. The
basic forensic examiner course covers
forensic and other examination issues and
has this same NTFS material in that
course.
The
course material is in-depth and is not just something that can be
picked up and simply read in order to understand the file system.
It will require studying. To facilitate the studying,
we will provide an image of Windows 2000 Pro and have a comprehensive practical exercise and final examination
that will help you to
"walk" through the structures and to understand the material.
The
NTFS training course is included as part of the Online Forensic
Training Course and the CCE BootCamp.
The course can be purchased and studied separately from
the Online Forensic Training Course and the CCE BootCamp.
The course fee is $550. There is a discounted fee of $495 for
Law Enforcement, Government, Military and Educators. The course fee
includes the course material, the practical exercise, a CD ROM image of a Windows 2000
Professional drive (not bootable), a highly qualified and knowledgeable
instructor and the final examination. You will be required
to download the demo version of a software product.
If you are paying with a credit card, you can
register through our site. Click
here
to go to our online registration page.
Registration
can also be completed at the Kennesaw State University Registrar's
office. Their web site is located at KSU - Registrar.
You can register online, by phone or by mail. The toll free phone
number is 800-869-1151.
Contact
Us
