- Gain extensive knowledge on encrypted electronic evidence
- Know how to locate, process, and decrypt encrypted files and disks
- Obtain required knowledge to set up password recovery attacks and to create and use custom dictionaries
- Discover how to maximize password recovery performance: hardware acceleration and distributed password recovery
- Learn the best practices to achieve the maximum success rate for decryption tasks
Course Outline
Session 1 What is Encryption and Decryption?
Session 2 Standard Forensic Procedures and Decryption Best Practices
Session 3 Passware Kit Forensic Overview
Session 4 Detecting Encrypted Files
Session 5 Types of Attacks Available in Passware Kit Forensic
Sessions 6 Batch Password Recovery
Sessions 7 Dictionary Manager
Sessions 8 Hardware Acceleration & Distributed Password Recovery
Sessions 9 Memory Analysis
Sessions 10 Full Disk Encryption
Sessions 11 FDE: BitLocker, TrueCrypt, and VeraCrypt
Sessions 12 FDE: FileVault/APFS Volumes
Sessions 13 Mobile Device Backups and Apple Keychain
Sessions 14 Resetting a Windows Admin Password
Sessions 15 Standalone System
Sessions 16 Hashes
FAQ:
Is this an online course, or is it in a classroom?
This is an online, self-paced video course, so you can learn at your own speed.
What software/hardware do I need for this course?
You need Passware Kit Forensic installed on your computer, Internet access, and speakers or headphones.
Do I need a working license of Passware Kit Forensic to use this course?
Yes. Your license of Passware Kit Forensic must be up to date. The training users may request a free trial version of Passware Kit Forensic to complete the course.
Will I get a certificate at the end of this course?
Yes. After completing the course, students can take the exam to receive the Passware Certified Examiner (PCE) designation.
What do I need to pass?
The passing score is 80%, with 63 questions in total for the test.
How long is the certificate valid?
The certificate is valid for two years.
How much time do I have to complete the course?
Access to the training is valid for one year from the course start date.
