Reviewed by Scar de Courcier, Forensic Focus
During the first week of December 2014, Guidance Software ran a computer forensics training course at its Slough offices in the UK, with the aim of helping forensic practitioners to understand and use EnCase as part of their investigations.
Background
The course was developed by Guidance Software with a view to introducing new digital forensics practitioners to the field. The students are usually new IT security professionals, law enforcement agents and forensic investigators, and many have minimal training in computing.
Computer Forensics I is available both in person at one of Guidance Software’s training centres, or online via their OnDemand solution, which provides live remote classes for students around the world.Course Structure
Upon arriving at the venue, I received a course manual which covered the subjects we would be studying. This proved useful throughout the week as it contained all of the slides the instructors were using in their presentations, as well as some extra information about each element of the course. The manual made it easy to keep up with the pace of the lessons and was particularly helpful during some of the practical exercises. There were step-by-step instructions on how to use EnCase throughout an investigation, which proved useful during the course itself but would also be valuable to anyone who is using EnCase in their day-to-day work.
The training began quite early every day, with students in the building by 8am. Two trainers, Bill Thompson and Carl Purser, split the delivery between themselves with Bill training for the majority of the first couple of days and Carl taking more lessons towards the end of the week. Everyone in the class was introduced to each other and there was time in between lessons to speak to other students and learn about their professions. This, coupled with the anecdotes and laid-back training style of both the instructors, made the course particularly enjoyable.
Our first few lessons covered the basics of forensic methodology and case creation, including how to store case files in an accurate and useful manner, how to provide continuity in order to demonstrate where evidence has been located at all times, and what to do when things go wrong. The course also covered some of the legalities surrounding forensic examination, including how to ensure that you are legally allowed to perform a search & seizure, and how to document a crime scene upon arrival.
There was a strong focus on safety, with a section dedicated to ensuring the security of the forensic examiner, something that is not always touched upon during training and talks about digital forensics. This was particularly helpful to new practitioners in the field as it gave an idea of the kinds of things investigators should be looking out for, and how to avoid ending up in compromising situations. The instructors included some examples from their own cases and those of their colleagues, which helped to bring their lectures to life and demonstrate how the things we were learning could be applied in the real world.
Once the basics of forensic investigation had been covered, we moved on to navigating EnCase itself. An especially useful part of this lesson was the explanations given by the instructors about why certain features had been added. They took care to explain not only the function of each option but its background; when it had been added, and how some features differed from previous versions of EnCase. This allowed the students to see how EnCase is constantly being improved and updated, and made it easier to remember to perform certain tasks which might otherwise have been overlooked.
Certain parts of EnCase were revisited again and again, which solidified them in our memories and meant that by the end of the week some things, such as checking the ‘Dixon box’ to ensure that no extra elements had been selected, or ‘set including’ within a particular folder to show all entries, files and subfolders, became almost second nature before continuing with our investigations.
Some time was set aside to discuss the manifold places from which digital evidence can nowadays be gleaned, with examples including a video camera housed inside a child’s doll. This served to underline the importance of checking a scene thoroughly, and of knowing how to use several different tools to examine evidence from a wide variety of sources.
We delved into creating digital evidence files from thumb drives, including how to use different methods of encryption and how these are incorporated into EnCase itself. After this we spent some time discussing binary and hexadecimal, going over the ways in which data are stored and doing some translation exercises to get us used to working with binary and hex.
The course then included some information on how computers are put together in terms of hardware, which was an interesting element and one that is not always included when discussing digital forensics. This was helpful as it gave students an idea of what is physically going on behind the scenes while an investigator is collecting evidence and analysing data.
A description of file structures followed, along with examples of how the same evidence is stored on different systems, and how all of these can be examined using EnCase. Throughout the course we worked on two main example cases, which was helpful as it meant we could cross-check evidence easily and compare how the same file looked when using different methods to examine it.
The bookmarking options in EnCase were explained at length, which helped us to understand how these feed into the reports which are automatically generated at the end of an examination.
We then spent the majority of a day discussing keyword analysis and search queries, including how to ensure that the correct search terms are being used and how to cross-reference keywords from different evidence sources. Again, the textbook proved to be very helpful here, as its step-by-step instructions demonstrated exactly how to create the necessary searches and included screenshots of EnCase itself with arrows illustrating which items to include and in which order. We spent some time going over how to write search terms effectively to bring back the most relevant results, and the specific syntax of EnCase’s own searching structure.
Hash analysis, which is of course one of the backbones of digital forensic investigations, was covered towards the end of the week, once all the basics had been explained. This meant that by the time we started looking at creating hash sets and managing hash libraries, we already had a solid understanding of both EnCase and the evidence sources being examined.
The final part of the course involved a more thorough look at EnCase’s reporting capabilities, followed by a lesson on backing up and restoring cases where necessary. The course concluded with a final practical exercise using the cases we had been introduced to earlier in the week. This allowed the students to apply the knowledge gained during the course to a simulated scenario and helped to solidify our knowledge of how to use EnCase in a digital investigation.
Evaluation
The course moved at a good pace, with the instructors taking time to explain things where necessary but not dwelling for too long on individual elements of EnCase. Both Bill and Carl were very patient with all the students, taking the time to ensure that everyone was keeping up, and helping those who fell behind from time to time.
At the end of each section there was time for questions, and both of the instructors made themselves available during lunchtimes and at the end of the day for anyone who wanted to ask extra questions or go over what they had learned.
Whilst the course itself was focused on using EnCase, the instructors also described how to include certain other tools as part of an investigation, and there were several free resources provided for students to take away with them once the course had ended. These included a LinEn disk, which contained the Linux version of the EnCase acquisition tool; some instructional documents concerning EnCase itself and digital forensics investigations in general; and some research papers in the digital forensics and computer security fields.
Overall, my experience with the EnCase Computer Forensics I training was very positive. I left at the end of the week feeling confident that I could use EnCase effectively during my own investigations, and also with a renewed interest in and understanding of digital systems and their use in criminal investigations.
Learn more about training courses available from Guidance Software here.
