Date/Time
Date(s) - Tue, Aug 11, 2015 - Thu, Aug 13, 2015All Day
Location
Brevard County Sheriff’s Office East PrecinctIEF ESSENTIALS CERTIFICATON COURSE
OVERVIEW
The new 3-Day IEF Essentials in-class training course, has been developed to provide students with detailed instruction on the features, and functions of IEF; key artifacts supported by IEF; the interoperability of IEF and other forensic tools; and the importance of including IEF in the investigative workflow. The course also includes extensive instructor-led and student practical exercises, based on real world scenarios, to help reinforce the learning concepts. At the conclusion of the course, students will participate in a Practical Skills Assessment (PSA) designed to test their understanding and practical application of the course materials.
OBJECTIVES
- Installation and usage of each edition of IEF
- Supported data sources and corresponding search types
- Supported Internet artifact types
- Working in IEF Report Viewer
- Analyzing case data in IEF Report Viewer
- Using IEF visualization tools
- Building reports and sharing IEF Portable Cases
WHO SHOULD ATTEND
The 3-Day IEF Essentials course is designed to meet the needs of examiners within the law enforcement, government, military, and private sector forensics communities. Investigators who are just starting out with IEF, or have been using IEF without formal training, will leave the course with an understanding of the full functionality of IEF, and the benefits of incorporating IEF into the investigative workflow. Students will learn how to locate, analyze, and report on Internet trace evidence, business applications, and operating system files from PC and mobile evidence sets.
COURSE OUTLINE
Module 1: Introduction and Product Installation
This module includes an overview of the course, and provides background information about Magnet Forensics, as well as the Internet Evidence Finder (IEF) product line, and licensing options. If an Internet connection is available during class, we will also conduct a brief overview of additional investigative resources on Magnetforensics.com. The module will conclude with the installation of Magnet Forensics software, setup of classroom computer, and review of student materials.
Module 2: Internet Evidence Finder (IEF) Main Interface
This module provides the students with a detailed walk through of the IEF user interface. Students will launch the IEF client and explore all of the menu options (File, Tools, Licensing, and Help), and evidence selection options (Drives, Files & Folders, Images, Volume Shadow Copies, and Mobile) from the main window.
Module 3: Adding Evidence and Managing Search Profiles
Students will learn the search levels (Full, Quick, Sector Level, and Custom) which can be applied to evidence, during the creation of a case. In addition, they will also learn how to create custom search profiles to target specific artifact categories; manage custom search settings within an existing case; and use the import and export features to share search profiles between cases in IEF.
Module 4: IEF Report Viewer User Interface
This block of instruction introduces students to the IEF Report Viewer interface. Students will learn how to use the menu and navigation features within the Report Viewer, and locate artifacts recovered during the search process.
Module 5: Artifact Categories
This module explores the various artifact categories recovered within IEF. The module will also include a detailed examination of how IEF parses the artifacts, with an emphasis on the locations within the evidence, such as system files, user profiles, databases, and unallocated space. The module will provide the students with an understanding of how IEF “locates” evidence, and how the artifacts recovered in IEF can be useful in validating the findings of other forensic tools.
Module 6: Managing Searches
In this module, students will learn about the various search options within IEF, and how they can be used to narrow the focus of their investigations. Topics will include the use of user-defined, and pre-defined regular expressions; keyword searches; and importing and exporting keywords and regular expressions.
Module 7: Managing Filters
This module introduces students to the filtering capabilities of IEF, and how they can be used to narrow the focus of their investigations. Topics include creating filters from a list of predefined attributes; importing filters; exporting filters; and applying a global date/time filters to the recovered artifacts in an IEF case.
Module 8: Managing Bookmarks
In this module, students will learn about the bookmarking functionality of IEF, and how bookmarks can be used to identify categories of artifacts relevant to an investigation. Topics will include creating and deleting bookmarks; using the summary editor feature to add bookmark comments to the case report; exporting bookmarked items; and generating a case report for bookmarked artifacts.
Module 9: Timeline and World Map Interfaces
This module will familiarize the students with the IEF Timeline interface. Topics will include the various methods for launching the Timeline and World Map interfaces; analyzing selected artifact categories within the Timeline and World Map interfaces; bookmarking relevant artifacts; using the screen capture feature; and, incorporating Timeline and World Map results into the IEF case report.
Module 10: Case Reporting
In this block of instruction, students will incorporate their understanding of the previous learning modules to generate the final case report. Topics will include the implementation of searches, filters, the Timeline and World Map interfaces, bookmarks, and the summary editor to create a case report.
Module 11: IEF Portable Cases
In this module, students will learn how to create a portable IEF case, which can be provided to other personnel associated with the investigation. Topics include the management of bookmarks; selection of artifact categories; and creating a portable report with and without the stand-alone IEF Report Viewer.
Module 12: Practical Skills Assessment (PSA)
This module is a cumulative set of practical exercises designed to test the student’s understanding and application of the learning concepts presented throughout the course. Students will answer questions based on their ability to process an evidence set with IEF.
NOTE: Classes are subject to cancellation if there are not at least 8 participants signed up for the class. If cancellation does occur, each participant will be notified at least two weeks prior to start of the class. Please hold off making any fights or hotel accomodations until two weeks prior to the class.
Digital Shield is NOT responsible for costs associated with cancellation of classes such as flight and hotel accomodations for participants. Cost of the training class would be reimbursed back to the participant 100%.
Point of Contact for the training –
Joe Church
321-704-1336
jchurch@digitalshiel.net