Whether you are looking to gain expertise in smartphone or computer digital forensics using Magnet IEF, Magnet IEF Examinations (IEF200) is the right course for you. Participants will gain expert-level competence using IEF for investigations involving smartphones, computers, or both.
IEF Examinations (IEF200) is an intermediate level course, designed for participants who are familiar with the principles of digital forensics, and seeking to use Magnet IEF for their investigations. After the four-day training event, participants will have the knowledge and skills they need to configure Magnet IEF to recover key artifacts from computer and smartphone evidence platforms; use the IEF Report Viewer to explore the evidence, link facts, data, and potential user activities across multiple evidence platforms; and, prepare key artifacts for collaboration with other stakeholders. Each module of instruction employs extensive scenario-based, hands-on exercises in Magnet IEF, to reinforce the learning objectives, and further enhance the participant’s understanding of Magnet IEF functionality, and its application within the forensic workflow.
Objectives of Magnet IEF Examinations
- Installation of IEF
- Configuration of case-specific and global search profiles in IEF
- Analyzing case data in IEF Report Viewer
- Utilization of hash sets, keywords, regular expressions, and filters to identify key artifacts
- Application of bookmarks, tags, and comments to prepare case evidence for exporting and reporting
- IEF Report Viewer tips for achieving greater investigative efficiency
- Using IEF visualization tools to emphasize user behavior patterns
- Enhance participant understanding of key artifacts; their locations and formats; the user and system behaviors which created them; and, the manner in which IEF recovers them
- Building intuitive reports and sharing portable cases with stakeholders
Training Class Schedule
|Classroom Instructor-Led||Herndon, VA||May 8-11|
|Classroom Instructor-Led||Princes Risborough, UK||June 26-29|
|Classroom Instructor–Led||Herndon, VA||August 14-17|
|Classroom Instructor-Led||Wyboston, UK||September 11-14|
|Classroom Instructor–Led||Herndon, VA||October 9-12|
|Virtual Instructor-Led||Online (CST)||November 13-16|
AUTHORIZED TRAINING PARTNER SCHEDULE
Classroom Instructor-Led Training
|Kandel, Germany||October 10-13|
IEF Examinations Module Descriptions
Module 1: Intro and Installation of Magnet IEF
In this introductory module, participants will be presented with the learning objectives and expected outcomes for the four-day training event, and all related course materials. The module will conclude with hands-on exercises during which participants will install Magnet IEF, and learn about its associated programmatic components.
Module 2: Evidence Processing and Case Creation
This module of instruction will focus on the features available in Magnet IEF for selecting evidence sources; configuring case-specific and global settings for the recovery of key artifacts; and, creating the investigative case data set. After the creation of the case, participants will be introduced to the IEF Report Viewer interface, to analyze case evidence. The module includes scenario-based instructor-led, and student practical exercises, to reinforce the learning objectives, and apply IEF to an investigative workflow.
Module 3: Computer Artifact Analysis
The Computer Artifact Analysis section of the course is composed of several modules, each of which focusing on a specific set of key artifacts most commonly encountered during the analysis of computer evidence. The modules within this section will include presentations on Refined Results, Chat clients, Documents, Email, Media, Social Networking, Internet browsers, and operating system artifact analysis. For each of the modules, scenario-based instructor-led and student practical exercises will be used to demonstrate the navigation, searching, filtering, bookmarking, and tagging features in the IEF Report Viewer, and reinforce the learning objectives.
Module 4: Mobile Artifact Analysis
The Mobile Artifacts Analysis section is composed of two modules, one focusing on iPhone artifacts, and the second on Android artifacts. Participants will explore smartphone evidence, parsed by Magnet IEF, from each operating system. In addition, the modules will explore the device file systems and structures to recover additional information, including device owner information; third party application data; core operating system data; Internet browser data; and, more. Scenario-based, instructor-led, and student practical exercises will be used to demonstrate the navigation, searching, filtering, bookmarking, and tagging features in the IEF Report Viewer, and reinforce the learning objectives.
Module 5: Reporting
In this final instructional module of the course, participants will explore the various exporting and reporting features available within the IEF Report Viewer interface, used for the presentation of case evidence, and collaboration with other investigative stakeholders. Through the scenario-based instructor-led, and student practical exercises, participants will learn how to manage the exporting of artifacts; produce portable cases; and, create a final investigative case report which is easily interpreted by both technical and non-technical recipients.
Module 6: Cumulative Review Exercises
Throughout the four-day training event, instructor-led and student practical exercises are used to reinforce the learning objectives and provide the participants with the knowledge and skills necessary to successfully utilize Magnet IEF in their investigative workflow. To further reinforce the instructional goals of the course, students are presented with a final scenario-based practical exercise which represents a cumulative review of the exercises conducted in each of the individual modules.