Alvarez & Marsal offers a full suite of Guidance EnCase® training courses, from the introductory EnCase I course, designed for investigators with minimal computer skills, to the EnCase® Exam Prep course, designed for EnCase® users preparing to take their EnCE® exam.
Printable versionSend by emailPDF version
May 23, 2016

The following courses are designed to teach not only the theory, but also the practical skills that can be immediately employed at your office or lab. Throughout each EnCase® course, students will use EnCase® software hands-on, covering the acquisition and handling of evidence, understanding the evidence file, case creation, keyword searches, hashing, signature analysis, bookmarking and reporting their findings, and other similar skills. Participants will also review the body of knowledge required to perform computer forensics, including computer science, forensic terminology and applicable law.


EnCase II

EnCase® V7 Computer Forensics I

  • EnCase v7 computer forensic methodology
  • Basic structures of the FAT, NT, and ExFAT file systems
  • Conducting raw and index searches
  • Analyzing file signatures and view files
  • Conducting hash analysis and importing hash sets

EnCase® V7 Computer Forensics II

  • Recovering encrypted information
  • Locating and recovering deleted file partitions and folders
  • EnCase® Evidence Processor
  • EnCase® Virtual File System (VFS) and EnCase® Physical Disk Emulator (PDE)
  • Identifying Windows 7 OS artifacts


  • Using EnCase® Forensic v7 software to review the skill set required to address the EnCE practical examination

ENCASE® V7 Enterprise Examinations

  • Secure Authentication for EnCase® (SAFE)
  • Deploying servlets to supported operating systems
  • Optimizing network acquisitions in Enterprise v7 security
  • Acquiring data at a physical and logical level
  • Creating filters and conditions to streamline investigations