This lab-based lesson covers obtaining the Windows Bitlocker Encryption Keys which allows an investigator to get a hard drive image as these keys are necessary to unlock the system. An investigator can obtain two types of images: physical and logical. Using the FTK Imager, participants receive step by step instructions in how to obtain images.
Incident Response and Advanced Forensics
In this course, you will gain an introduction to Incident Response, learn how to develop three important protection plans, perform advanced forensics on the incident, deep dive into insider and malware threats, and commence incident recovery.