“X-Ways Forensics I”  is a 4 day training course focused on the systematic and efficient examination of computer media using the integrated computer forensics software       "X-Ways Forensics”.  Many topics will be explained along with their theoretical background (slack space, partially initialized space, how hash databases are internally structured, how deleted partitions are found automatically, with what methods X-Ways Forensics finds deleted files, etc. etc.).  Other topics, such as forensically sound disk imaging and cloning, data recovery, search functions, dynamic filtering, report creation, amongst others will be covered.

The students will be instructed, for example, on how to get the most thorough overview of existing and deleted files and data from computer media, suggestions on the most efficient ways to process cases relating to CSAM (child sexual abuse material), etc.    At the end of the course there will be a practical exam that can treated as just another exercise or be marked by the instructor.  This exam covers the most important functions of X-Ways Forensics and helps to gauge your proficiency. (individual results are not recorded).  Printed materials for the course will be provided for later repetition.  Basic knowledge of computer forensics is a prerequisite.

The approach of this course is very tool-centred.  After attending the course a Certificate of Attendance will be issued from X-Ways Software Technology AG, and will allow the attendee to be eligible to attempt the X-PERT Certification. 

Course Info