This event is sponsored by Technology Pathways.

The training: "Understanding and Investiating Microsoft Volume Shadow Copy."

Description: Field investigators often need to find information fast in the field. Recovering deleted files and performing advanced searches are often time consuming and thus prohibitive for field investigators. Both live system triage and analysis of off line images containing Microsoft VSC "Volume Shadow Copy" snapshots can often net a wealth of information to investigators who know how to process it.

Over the past two years several papers and bloggers have discussed a variety of ways to process Microsoft's VSC. This presentation summarizes some of the existing methods and tools as well as introduces new methods and tools for quick collection and analysis with ProDiscover. Clear attention is drawn to which methods can be used for live system triage and which to use for off line investigation.

Bio: Christopher L.T. Brown, CISSP is the Founder and CTO of Technology Pathways. Mr. Brown is the chief architect of the Technology Pathways ProDiscover family of security products. Priod to his position with Technology Pathways, Mr. Brown has served in key technology positions at several companies and focused on information warfare and network operations for the U.S. Navy. Mr. Brown's most recent book "Computer Evidence: Collection and Preservation 2nd Edition" is published by Charles River Media. He has over 25 years' experience in hardware, software, and network engineering. Mr. Brown has taught computer security and network engineering for UCSD as well as private organizations such as Addison Wesley and CSI.

Location:

AIU Dunwoody

500 Embassy Row

Atlanta, GA 30328