• Online, Self-Paced
In this course we will look at forensic collection of fully encrypted Windows and Mac computers with Evimetry.

Learning Objectives

By the end of this course, students should be able to: How to identify a BitLocker’d or FileVault’d disk by signature Acquire a FileVault’d Mac with Evimetry Use Mount Image Pro to decrypt Windows and Mac encrypted volumes

Framework Connections

The materials within this course focus on the Knowledge Skills and Abilities (KSAs) identified within the Specialty Areas listed below. Click to view Specialty Area details within the interactive National Cybersecurity Workforce Framework.

Feedback

If you would like to provide feedback for this course, please e-mail the NICCS SO at NICCS@hq.dhs.gov.