Surviving Encryption

Please Click Here for Online Class Registration!

This training class will give students the knowledge and skills to meet the challenges of digital encryption using the top techniques and software available such as Passware Forensic Kit. Students will gain an understanding of how encryption and cryptanalysis works to build core forensic analyst skills. Through hands-on practicals, students will learn how to apply decryption and password recovery techniques in different scenarios, to include, encrypted files, email passwords, Windows passwords, Apple passwords, encrypted volumes and more.

The student will be able to recognize encrypted artifacts, understand different types of encryption and formulate a strategy to recover encrypted data and by able to explain the process.  Students that successfully complete this Sumuri course will receive the Official Passware Certification.

Sumuri’s Surviving Encryption is the Official Passware Certification and Training course! Sumuri, as with all of their classes, goes beyond just the use of the tool. Sumuri realizes that our students require a thorough understanding of the concepts relating to the use of the tool in order utilize the software to its fullest capacity and also to qualify in any court of law! This is accomplished via expert led instruction, hands on practicals, real case scenarios and proper testing.

Sumuri and Passware are aware that budgets are tight for everyone. To help in keeping costs down Sumuri is offering Passware’s Official Certification and Training online to minimize travel costs. Additionally, your agency can opt to host this training course at your facility and receive up to two free seats! Finally, students who attend this training will get a special discount on Passware Kit Forensics software only available in conjunction with this course!

The Sumuri Team has developed and delivered training for some of the top forensics companies in the world. Now, Sumuri is proud to be selected as the Official Training Partner for Passware, Inc. and their Passware Kit Forensic Software!

Founded in 1998, Passware, Inc. is the worldwide leading developer of password recovery and e-Discovery software for Federal and State agencies, Fortune 500 corporations, law enforcement, military organizations, help desk personnel, business and private consumers.

Their flagship product – Passware Kit Forensic – has always been the first choice for computer forensic investigators and examiners. Passware Kit Forensic is a complete evidence discovery solution, providing immediate password recovery for any protected file detected on a PC or over the network while scanning, as well as instant decryption of hard disk images from the seized computers. Passware software products have been reviewed and recommended by major industry publications such as PC Magazine, PC World, Windows IT Pro, and others.

Course Description:
This three-day training class will give students the knowledge and skills to meet the challenges of digital encryption using Passware. Students will gain an understanding of how encryption and cryptanalysis works to build core forensic analyst skills. Through hands-on practicals, students will learn how to apply Passware in different scenarios, to include, encrypted files, email passwords, Windows passwords, Apple passwords, encrypted volumes and more.

Course Objectives:

• The student will be able to recognize encrypted artifacts.
• The student will be able to understand different types of encryption and formulate a strategy to recover encrypted data.
• The student will be able to appropriately apply Passware tools to recover encrypted data and explain the process.

Course Topics to Include:

Overview of Encryption Techniques and Cryptographic Systems

Encryption & Encryption Recovery Methods

• Symmetric and Asymmetric Encryption
• Brute Force Attacks
• Dictionary Attacks
• Hash Attacks
• Rainbow Tables Attack
• Algorithmic Weakness

Passware Kit Forensic Overview

• Passware Kit Forensic Installation Options

• Instructor Led Walkthrough of Functions
• Passware Attacks
• Choosing Hardware for Passware
• Hardware Accelerated Recovery
• Passware Portable Kit
• Logging

Hands on Practicals

• Scanning computers and image files to identify encrypted files
• Decrypting TrueCrypt, PGP, Filevault2, DMG and Bit Locker to-go volumes
• Using the Attack Wizard (perfect for novice users!)
• Using the Attack Editor to build custom attacks (9 different types)

Exploring a variety of attack modifiers, to include:

• Casing options
• Using dictionary & non-dictionary words
• Attacking different parts of a password
• Combining different types of attacks
• Exploiting common password patterns
• Exploiting known partial passwords 
• Attacks that can include several languages
• Precision substitution attacks
• And other options that maximize the potential for a successful password recovery

Using Dictionary attacks such as:

• Publicly available word lists
• Custom dictionaries
• Dictionaries created from RAM dumps
• Dictionaries created from Hibirfil.sys files

Also:

• Using Passware’s Xieve Attack
• Methods to recover Windows Login passwords
• Methods to recover Mac Logon passwords
• Recovering Mac Keychains
• Rainbow Tables Attacks (to include creating them!)

Practical Skills Assessment:

Cumulative scenario-based practical that encompassing the information and techniques taught during this course to show that the student can utilize Passware in a realistic scenario.

Certification Exam:
Designed to show that the student has understood concepts and techniques taught throughout this course to an appropriate level relating to digital encryption, decryption and the use of Passware Kit Forensic Suite.

System Requirements for Passware Kit Forensic Software:

• Microsoft Windows XP, Server 2003/2008, or Windows 7 (32-bit or 64-bit) installed and configured on your system
• 1 GHz processor (2.4 GHz recommended)
• 2-4 GB RAM
• 50 GB Free Space
• High-speed Internet Connection

System Requirements for Online Sessions:

For PC-based participants:

• Internet Explorer® 7.0 or newer, Mozilla® Firefox® 3.0 or newer or Google™ Chrome™ 5.0 or newer (JavaScript™ and Java™ enabled)
• Windows® 7, Vista, XP or 2003 Server
• Cable modem, DSL, or better Internet connection
• Dual-core 2.4GHz CPU or faster with 2GB of RAM (recommended)

Additional Information:
Participants wishing to connect to audio using VoIP will need a fast Internet connection, a microphone and speakers. (A USB headset is recommended.)

Manuals and instructions for preparing for the course will be mailed via USPS Priority Mail prior to the start of the course. Upon successful completion of the course students will receive their Official Passware Training Certification from Passware, Inc.