Difference between pages "Upcoming events" and "Gzip"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
(Or this?)
 
(File format)
 
Line 1: Line 1:
Here is a BY DATE listing of '''upcoming conferences and training events''' that pertain to [[digital forensics]]. Some of these duplicate the generic [[conferences]], but have specific dates/locations for the upcoming conference/training event.
+
{{expand}}
  
<b> The Conference and Training List is provided by the American Academy of Forensic Sciences (AAFS) Digital and Multi-media Listserv</b>
+
== File format ==
<i> (Subscribe by sending an email to listserv@lists.mitre.org with message body containing SUBSCRIBE AAFS-DIGITAL-MULTIMEDIA-LIST)</i>
+
The gzip file (.gz) format consists of:
<b> Any requests for additions, deletions or corrections to this list should be sent by email to David Baker <i>(bakerd AT mitre.org)</i>. </b>
+
* a file header
 +
* optional headers
 +
** extra fields
 +
** original file name
 +
** comment
 +
** header checksum
 +
* a body, containing a DEFLATE-compressed payload
 +
* a file footer
  
== Test test test ==
+
The gzip format uses little-endian.
  
=== How about this? ===
+
{| class="wikitable"
 +
! align="left"| Offset
 +
! Characteristics
 +
! Description
 +
|-
 +
| Byte order
 +
| little-endian
 +
|-
 +
| Date and time values
 +
| Filetime in UTC
 +
|-
 +
| Character string
 +
| ISO 8859-1 (LATIN-1)
 +
|}
  
; LayerOne 2006
+
=== File header ===
: Apr 15-16, Los Angeles, CA
+
The file header is 10 bytes in size and contains:
: http://www.layerone.info/index.html
+
{| class="wikitable"
 +
! align="left"| Offset
 +
! Size
 +
! Value
 +
! Description
 +
|-
 +
| 0
 +
| 2
 +
| 0x1f 0x8b
 +
| Signature (or identification byte 1 and 2)
 +
|-
 +
| 2
 +
| 1
 +
|
 +
| Compression Method
 +
|-
 +
| 3
 +
| 1
 +
|
 +
| Flags
 +
|-
 +
| 4
 +
| 4
 +
|
 +
| Last modification time <br> Contains a POSIX timestamp.
 +
|-
 +
| 8
 +
| 1
 +
|
 +
| Extra flags
 +
|-
 +
| 9
 +
| 1
 +
|
 +
| Operating system <br> Value that indicates on which operating system the gzip file was created.
 +
|}
  
; 2006 GFIRST Conference
+
==== Compression method ====
: Apr 30-May 05, Orlando, FL
+
: http://www.us-cert.gov/GFIRST
+
  
; Computer and Enterprise Investigations Conference (CEIC) 2006
+
{| class="wikitable"
: May 03-06, Las Vegas, NV
+
! align="left"| Value
: http://www.ceic2006.com
+
! Identifier
 +
! Description
 +
|-
 +
| 0 - 7
 +
|
 +
| Reserved
 +
|-
 +
| 8
 +
| "deflate"
 +
| zlib compressed data
 +
|}
  
; ...
+
==== Flags ====
: ...
+
: ...
+
  
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
{| class="wikitable"
|- style="background:#bfbfbf; font-weight: bold"
+
! align="left"| Value
! Title
+
! Identifier
! Date
+
! Description
! Location
+
! Website
+
 
|-
 
|-
|2006 Techno-Security Conference
+
| 0x01
|Jun 04-07
+
| FTEXT
|Myrtle Beach, SC
+
| If set the uncompressed data needs to be treated as text instead of binary data. <br> This flag hints end-of-line conversion for cross-platform text files but does not enforce it.
|http://www.techsec.com/html/Techno2006.html
+
 
|-
 
|-
|CSI Netsec Conference
+
| 0x02
|Jun 12-14
+
| FHCRC
|Scottsdale, AZ
+
| The file contains a header checksum (CRC-16)
|http://www.gocsi.com/netsec/
+
 
|-
 
|-
|RECON 2006
+
| 0x04
|Jun 16-18
+
| FEXTRA
|Montreal, Quebec, Canada
+
| The file contains extra fields
|http://recon.cx
+
 
|-
 
|-
|Information Hiding Conference 2006
+
| 0x08
|Jul 10-12
+
| FNAME
|Alexandria, VA
+
| The file contains an original file name string
|http://ih2006.jjtc.com
+
 
|-
 
|-
|Detection of Intrusions and Malware & Vulnerability Assessment 2006
+
| 0x10
|Jul 13-14
+
| FCOMMENT
|Berlin, Germany
+
| The file contains comment
|http://www.dimva.org/dimva2006
+
 
|-
 
|-
|BlackHat Briefings and Training
+
| 0x20
|Jul 29-Aug 03
+
|  
|Las Vegas, NV
+
| Reserved
|http://www.blackhat.com/html/bh-link/briefings.html
+
 
|-
 
|-
|15th USENIX Security Symposium
+
| 0x40
|Jul 31-Aug 04
+
|  
|Vancouver, BC, Canada
+
| Reserved
|http://www.usenix.org/events/sec06/
+
 
|-
 
|-
|DefCon 14
+
| 0x80
|Aug 04-06
+
|  
|Las Vegas, NV
+
| Reserved
|http://www.defcon.org
+
|}
 +
 
 +
<b>Note:</b> The FHCRC bit was never set by versions of gzip up to 1.2.4, even though it was documented with a different meaning in gzip 1.2.4.
 +
 
 +
==== Extra flags ====
 +
If compression method is 8 the following extra flags can be defined:
 +
{| class="wikitable"
 +
! align="left"| Value
 +
! Identifier
 +
! Description
 
|-
 
|-
|RCFG International Training Symposium 2006 - GMU
+
| 0x02
|Aug 07-11
+
|
|Fairfax, VA
+
| compressor used maximum compression, slowest algorithm
|http://www.rcfg.org/
+
 
|-
 
|-
|Digital Forensics Research Workshop 2006
+
| 0x04
|Aug 14-16
+
|
|Lafayette, IN
+
| compressor used fastest algorithm
|http://www.dfrws.org
+
|}
 +
 
 +
==== Operating System ====
 +
{| class="wikitable"
 +
! align="left"| Value
 +
! Identifier
 +
! Description
 
|-
 
|-
|E-Crime and Computer Evidence 2006
+
| 0
|Sep 12-14
+
|
|Nottingham, UK
+
| FAT filesystem (MS-DOS, OS/2, NT/Win32)
|http://www.ecce-conference.com
+
 
|-
 
|-
|International Conference on IT-Incident Management & IT-Forensics
+
| 1
|Oct 18-19
+
|
|Stuttgart, Germany
+
| Amiga
|http://www.imf-conference.org
+
 
|-
 
|-
|HTCIA 2006 International Training Conference and Expo
+
| 2
|Oct 29-Nov 01
+
|
|Cleveland, OH
+
| VMS (or OpenVMS)
|http://www.ohiohtcia.org/conf_main.html
+
 
|-
 
|-
|2006 Techno Forensics Conference
+
| 3
|Nov 6-8
+
|
|Gaithersburg, MD
+
| Unix
|http://www.techsec.com/html/TechnoForensics2006.htm
+
 
|-
 
|-
|4th Australian Digital Forensics Conference
+
| 4
|Dec 04
+
|
|Edith Cowan University (ECU) Mount Lawley Campus, Western Australia
+
| VM/CMS
|http://scissec.scis.ecu.edu.au/conferences2006/index.php?cf=3
+
 
|-
 
|-
 +
| 5
 +
|
 +
| Atari TOS
 +
|-
 +
| 6
 +
|
 +
| HPFS filesystem (OS/2, NT)
 +
|-
 +
| 7
 +
|
 +
| Macintosh
 +
|-
 +
| 8
 +
|
 +
| Z-System
 +
|-
 +
| 9
 +
|
 +
| CP/M
 +
|-
 +
| 10
 +
|
 +
| TOPS-20
 +
|-
 +
| 11
 +
|
 +
| NTFS filesystem (NT)
 +
|-
 +
| 12
 +
|
 +
| QDOS
 +
|-
 +
| 13
 +
|
 +
| Acorn RISCOS
 +
|-
 +
| 255
 +
|
 +
| unknown
 
|}
 
|}
  
=== Or this? ===
+
=== Optional headers ===
 +
==== Extra fields ====
 +
<b>TODO: add description</b>
  
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
The extra field are variable of size and contains:
|- style="background:#bfbfbf; font-weight: bold"
+
{| class="wikitable"
! Title
+
! align="left"| Offset
! Date
+
! Size
! Location
+
! Value
 +
! Description
 
|-
 
|-
| [http://www.layerone.info/index.html LayerOne 2006]
+
| 0
| Apr 15-16
+
| 2
| Los Angeles, CA
+
|  
 +
| Extra field data size <br> Value in bytes.
 
|-
 
|-
| [http://www.us-cert.gov/GFIRST 2006 GFIRST Conference]
+
| 2
| Apr 30-May 05
+
| Orlando, FL
+
|-
+
| [http://www.ceic2006.com Computer and Enterprise Investigations Conference (CEIC) 2006]
+
| May 03-06
+
| Las Vegas, NV
+
|-
+
| ...
+
| ...
+
 
| ...
 
| ...
 +
|
 +
| Extra field data
 
|}
 
|}
  
== Conferences ==
+
==== Original file name ====
 +
This is the original name of the file being compressed, with any directory components removed, and, if the file being compressed is on a file system with case insensitive names, forced to lower case.
  
<table>
+
Contains an ISO 8859-1 (LATIN-1) string with end-of-string character.
<tr><td class="events">LayerOne 2006<br>Apr 15-16, Los Angeles, CA<br>http://www.layerone.info/index.html</td></tr>
+
 
<tr><td class="events">2006 GFIRST Conference<br>Apr 30-May 05, Orlando, FL<br>http://www.us-cert.gov/GFIRST</td></tr>
+
==== Comment ====
<tr><td class="events">Computer and Enterprise Investigations Conference (CEIC) 2006<br>May 03-06, Las Vegas, NV<br>http://www.ceic2006.com</td></tr>
+
Contains an ISO 8859-1 (LATIN-1) string with end-of-string character. Line breaks should be denoted by a single line feed character.
<tr><td class="events">HTCIA  Silicon Valley Training Conference 2006<br>May 08-10, Santa Clara, CA<br>http://htciatraining.org/general_info.asp</td></tr>
+
 
<tr><td class="events">21st IFIP International Information Security Conference<br>May 22-24, Karlstad, Sweden<br>http://www.sec2006.org</td></tr>
+
==== Header checksum ====
<tr><td class="events">2006 USENIX Annual Technical Conference<br>May 30-Jun 03, Boston, MA<br>http://www.usenix.org/events/usenix06/</td></tr>
+
The header checksum contain a CRC-16 that consists of the two least significant bytes of the CRC-32 for all bytes of the gzip header up to and not including the CRC-16.
<tr><td class="events">2006 Techno-Security Conference<br>Jun 04-07, Myrtle Beach, SC<br>http://www.techsec.com/html/Techno2006.html</td></tr>
+
 
<tr><td class="events">CSI Netsec Conference<br>Jun 12-14, Scottsdale, AZ<br>http://www.gocsi.com/netsec/</td></tr>
+
=== File footer ===
<tr><td class="events">RECON 2006<br>Jun 16-18, Montreal, Quebec, Canada<br>http://recon.cx</td></tr>
+
The file footer is 8 bytes in size and contains:
<tr><td class="events">Information Hiding Conference 2006<br>Jul 10-12, Alexandria, VA<br>http://ih2006.jjtc.com</td></tr>
+
{| class="wikitable"
<tr><td class="events">BlackHat Briefings and Training<br>Jul 29-Aug 03, Las Vegas, NV<br>http://www.blackhat.com/html/bh-link/briefings.html</td></tr>
+
! align="left"| Offset
<tr><td class="events">15th USENIX Security Symposium<br>Jul 31-Aug 04, Vancouver, BC, Canada<br>http://www.usenix.org/events/sec06/</td></tr>
+
! Size
<tr><td class="events">DefCon 14<br>Aug 04-06, Las Vegas, NV<br>http://www.defcon.org</td></tr>
+
! Value
<tr><td class="events">RCFG International Training Symposium 2006 - GMU<br>Aug 07-11, Fairfax, VA<br>http://www.rcfg.org/</td></tr>
+
! Description
<tr><td class="events">Digital Forensics Research Workshop 2006<br>Aug 14-16, Lafayette, IN<br>http://www.dfrws.org</td></tr>
+
|-
<tr><td class="events">E-Crime and Computer Evidence 2006<br>Sep 12-14, Nottingham, UK<br>http://www.ecce-conference.com</td></tr>
+
| 0
<tr><td class="events">International Conference on IT-Incident Management & IT-Forensics<br>Oct 18-19, Stuttgart, Germany<br>http://www.imf-conference.org</td></tr>
+
| 4
<tr><td class="events">HTCIA 2006 International Training Conference and Expo<br>Oct 29-Nov 01, Cleveland, OH<br>http://www.ohiohtcia.org/conf_main.html</td></tr>
+
|
<tr><td class="events">2006 Techno Forensics Conference<br>Nov 6-8, Gaithersburg, MD<br>http://www.techsec.com/html/TechnoForensics2006.htm</td></tr>
+
| Checksum (CRC-32)
</table>
+
|-
 +
| 4
 +
| 4
 +
|
 +
| Uncompressed data size <br> Value in bytes.
 +
|}
  
== On-going / Continuous Training ==
+
== See Also ==
 +
* [[bz2 file]]
  
<table>
+
== External Links ==
<tr><td class="events">Basic Computer Examiner Course<br>Computer Forensic Training Online<br>http://www.cftco.com</td></tr>
+
<tr><td class="events">MaresWare Suite Training<br>First full week every month, Atlanta, GA<br>http://www.maresware.com/maresware/training/maresware.htm</td></tr>
+
<tr><td class="events">Linux Data Forensics Training<br>Distance Learning Format<br>http://www.crazytrain.com/training.html</td></tr>
+
</table>
+
  
== Scheduled Training Courses ==
+
* [http://www.gzip.org/format.txt The gzip file format], by the [http://www.gzip.org/ gzip project]
 +
* [http://www.gzip.org/algorithm.txt The gzip compression algorithm], by the [http://www.gzip.org/ gzip project]
 +
* [http://tools.ietf.org/html/rfc1952 RFC1952: GZIP file format specification version 4.3], by [[IETF]]
 +
* [http://en.wikipedia.org/wiki/Gzip Wikipedia: gzip]
  
<table>
+
[[Category:File Formats]]
<tr><td class="events">Catching the Hackers Intro to IDS<br>Apr 17-19, McLean, VA<br>http://www.securityuniversity.net/classes_introIDS.php</td></tr>
+
<tr><td class="events">Advanced SMART Linux Data Forensics Training<br>Apr 17-20, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">Investigation of Online Child Exploitation, Level I <br>Apr 17-21, Sacramento, CA<br>http://www.search.org/programs/hightech/calendar.asp<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Advanced Data Recovery and Analysis, Windows-ADRA-NTx<br>Apr 17-21, Birmingham, AL (Jefferson County Sheriffs Office)<br>http://nw3c.org/ocr/courses_desc.cfm?cn=NTx<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Ethical Hacking: Security Testing and Certified Ethical Hacker<br>Apr 17-21, Sierra Vista, AZ<br>http://www.infosecinstitute.com/courses/ethical_hacking_training.html</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Apr 18-20, San Francisco/Redwood City, CA<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Apr 18-21, Rancho Cordova, CA and Washington, DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Introduction to Computer Forensics <br>Apr 18-21, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Advanced Data Recovery and Analysis, Internet Trace Evidence-ADRA-INET<br>Apr 24-27, Buffalo Grove, IL (Buffalo Grove Police Department)<br>http://nw3c.org/ocr/courses_desc.cfm?cn=INET<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">The Investigation of Computer Crime <br>Apr 24-28, Edneyville, NC<br>http://www.search.org/programs/hightech/calendar.asp<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Basic Data Recovery and Aquisition-BDRA<br>Apr 24-28, Franklin, MA (NESPIN)<br>http://nw3c.org/ocr/courses_desc.cfm?cn=BDRA<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Applied Computer Forensics Boot Camp<br>Apr 24-28 , Atlanta, GA<br>http://www.vigilar.com/training_cce.html?mc=ggaw_Forensics_training</td></tr>
+
<tr><td class="events">Professional Hacking Business Class<br>Apr 24-28, Los Angeles, CA<br>http://www.vigilar.com/training_professional_hacking.html</td></tr>
+
<tr><td class="events">How to Break Software Security + SW Coding Fundamentals<br>Apr 24-28, McLean, VA<br>http://www.securityuniversity.net/classes_SI_SW_Security%20Testing_%20BP.php</td></tr>
+
<tr><td class="events">IACIS 2006 Annual Computer Forensic Training<br>Apr 24-May 05, Altamonte Springs, FL<br>http://www.cops.org<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">EnCase Advanced Internet Examinations <br>Apr 25-28, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Enterprise - Phase II <br>Apr 25-28, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting <br>Apr 25-28, Los Angeles, CA, Houston, TX and United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">SMART Linux Data Forensics Training<br>May 01-04, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">Windows Client Email Data Structures-EMAIL<br>May 01-05, Chicago, IL (Chicago Police Department)<br>http://nw3c.org/ocr/courses_desc.cfm?cn=EMAIL<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">CEH Ethical Hacking Certification Class<br>May 01-05, McLean, VA<br>http://www.securityuniversity.net/classes_CEH.php</td></tr>
+
<tr><td class="events">Seized Computer Evidence Recovery Specialist Training Program (SCERS)<br>May 01-12, FLETC, Glynco, GA<br>http://www.fletc.gov/cfi/fy06tibsched.htm<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">AccessData BootCamp<br>May 02-04, Glasgow, Scotland<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>May 02-04, Chicago, IL<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>May 02-05, Houston, TX and Canberra, Australia<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>May 02-05, Los Angeles, CA and Finland<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Introduction to Computer Forensics<br>May 02-05, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Advanced Data Recovery and Analysis, Windows-ADRA-NTx<br>May 08-12, Tallahassee, FL (Florida Department of Law Enforcement (FDLE))<br>http://nw3c.org/ocr/courses_desc.cfm?cn=NTx<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Anti-Hacking for Network Penetration Testing ECSA<br>May 08-12, Sunnyvale, CA<br>http://www.securityuniversity.net/classes_anti-hacking_pentest.php</td></tr>
+
<tr><td class="events">Professional Hacking Business Class<br>May 08-12, Chicago, IL<br>http://www.vigilar.com/training_professional_hacking.html</td></tr>
+
<tr><td class="events">AccessData BootCamp<br>May 09-11, St. Paul, MN<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>May 09-11, Durham, NC<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Field Intelligence Model/Mobile EE Live Network Investigations - Phase I<br>May 09-12, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>May 09-12, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Introduction to Computer Forensics<br>May 09-12, Houston, TX and United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase NTFS I : NTFS Artifacts and File Systems<br>May 09-12, The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Network Exploitation Analysis Training Program (NEATP)<br>May 09-18, FLETC, Glynco, GA<br>http://www.fletc.gov/cfi/fy06tibsched.htm<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Anti-Hacking for Trojans,Virus, Patch Mgt and Incident Response<br>May 15-17, Sunnyvale, CA<br>http://www.securityuniversity.net/classes_anti-hacking_trojans_virus_patchmgt.php</td></tr>
+
<tr><td class="events">EnCase NTFS II : Windows Networking Investigations<br>May 15-18, The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">The Investigation of Computer Crime <br>May 15-19, Moline, IL<br>http://www.search.org/programs/hightech/calendar.asp<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Basic Data Recovery and Aquisition-BDRA<br>May 15-19, Springdale, AR (Fayetteville Police Department)<br>http://nw3c.org/ocr/courses_desc.cfm?cn=BDRA<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Investigation of Computer Crime<br>May 15-19, East Moline, IL<br>http://www.search.org/programs/hightech/calendar.asp<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Advanced Internet Investigations <br>May 15-26, Sacramento, CA<br>http://www.search.org/programs/hightech/calendar.asp<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>May 16-18, New York, NY<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>May 16-19, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Field Intelligence Model/Mobile EE Live Network Investigations - Phase II<br>May 16-19, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>May 16-19, Houston, TX and United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Certified Wireless Network Administrator CWNA<br>May 20-23, McLean, VA<br>http://www.securityuniversity.net/classes_wireless_CWNA.php</td></tr>
+
<tr><td class="events">Certified Wireless Security Professional CWSP<br>May 20-23, McLean, VA<br>http://www.securityuniversity.net/classes_wireless_CWSP.php</td></tr>
+
<tr><td class="events">Boot Camp Certified Wireless Network Admin/ Wireless Security Professional<br>May 20-26, McLean, VA<br>http://www.securityuniversity.net/classes_wireless_CWSP.php</td></tr>
+
<tr><td class="events">E-mail Analysis & Reporting<br>May 22-24, Cerritos, CA<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_40&products_id=323</td></tr>
+
<tr><td class="events">Automated Forensic Tools-AFT<br>May 22-25, Anchorage, AK (Anchorage Police Department)<br>http://nw3c.org/ocr/courses_desc.cfm?cn=AFT<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Advanced SMART Linux Data Forensics Training<br>May 22-25, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">Certified Wireless Analyst Professional CWAP<br>May 22-26, McLean, VA<br>http://www.securityuniversity.net/classes_wireless_CWAP.php</td></tr>
+
<tr><td class="events">Professional Hacking Business Class<br>May 22-26, Columbia, MD<br>http://www.vigilar.com/training_professional_hacking.html</td></tr>
+
<tr><td class="events">Applied Computer Forensics Boot Camp<br>May 22-26 , Springfield, VA<br>http://www.vigilar.com/training_cce.html?mc=ggaw_Forensics_training</td></tr>
+
<tr><td class="events">EnCase Field Intelligence Model/Mobile EE Live Network Investigations - Phase I<br>May 23-26, United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>May 23-26, Houston, TX<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Introduction to Computer Forensics<br>May 23-26, Centennial, CO and Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Network Intrusion Investigations - Phase I<br>May 23-26, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>May 30-Jun 02, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Introduction to Computer Forensics<br>May 30-Jun 02, Houston, TX<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Certified Wireless Network Administrator CWNA<br>Jun 03-06, Sunnyvale, CA<br>http://www.securityuniversity.net/classes_wireless_CWNA.php</td></tr>
+
<tr><td class="events">Boot Camp Certified Wireless Network Admin/ Wireless Security Professional<br>Jun 03-10, Sunnyvale, CA<br>http://www.securityuniversity.net/classes_wireless_bootcamp.php</td></tr>
+
<tr><td class="events">SMART Linux Data Forensics Training<br>Jun 05-08, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">Basic Data Recovery and Aquisition-BDRA<br>Jun 05-09, Tampa, FL (Florida Department of Law Enforcement (FDLE))<br>http://nw3c.org/ocr/courses_desc.cfm?cn=BDRA<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Professional Hacking Business Class<br>Jun 05-09, San Francisco, CA<br>http://www.vigilar.com/training_professional_hacking.html</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Jun 06-09, United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Advanced Internet Examinations<br>Jun 06-09, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Jun 06-09, Houston, TX, Phoenix, AZ and Toronto, Canada<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Introduction to Computer Forensics<br>Jun 06-09, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase NTFS I : NTFS Artifacts and File Systems<br>Jun 06-09, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Computer Network Investigations Training Program (CNITP)<br>Jun 06-16, FLETC, Glynco, GA<br>http://www.fletc.gov/cfi/fy06tibsched.htm<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Certified Wireless Security Professional CWSP<br>Jun 07-10, Sunnyvale, CA<br>http://www.securityuniversity.net/classes_wireless_CWSP.php</td></tr>
+
<tr><td class="events">Cell Seizure Forensic Course<br>Jun 08-09, Myrtle Beach, SC<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_29&products_id=324</td></tr>
+
<tr><td class="events">Secure Techniques for Onsite Preview-STOP<br>Jun 12-13, Franklin, MA (NESPIN)<br>http://nw3c.org/ocr/courses_desc.cfm?cn=STOP<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Cell Seizure Forensic Course<br>Jun 12-13, Minneapolis, MN<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_29&products_id=338</td></tr>
+
<tr><td class="events">EnCase NTFS II : Windows Networking Investigations<br>Jun 12-15, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Investigation of Online Child Exploitation, Level I <br>Jun 12-16, Sacramento, CA<br>http://www.search.org/programs/hightech/calendar.asp<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">The Investigation of Computer Crime <br>Jun 12-16, Las Cruces, NM<br>http://www.search.org/programs/hightech/calendar.asp<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">CHFI Computer Hacking Forensics Investigator Certification<br>Jun 12-16, McLean, VA<br>http://www.securityuniversity.net/classes_CHFI.php</td></tr>
+
<tr><td class="events">Applied Computer Forensics Boot Camp<br>Jun 12-16 , Ft. Lauderdale, FL<br>http://www.vigilar.com/training_cce.html?mc=ggaw_Forensics_training</td></tr>
+
<tr><td class="events">The Investigation of Computer Crime <br>Jun 12-16, Las Cruces, NM<br>http://www.search.org/programs/hightech/calendar.asp<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Jun 13-15, Dallas/Addison, TX<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData Internet Forensics<br>Jun 13-15, Manchester, England-UK<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Jun 13-16, The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Advanced Internet Examinations<br>Jun 13-16, Houston, TX and United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Jun 13-16, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Introduction to Computer Forensics<br>Jun 13-16, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Secure Techniques for Onsite Preview-STOP<br>Jun 14-15, Franklin, MA (NESPIN)<br>http://nw3c.org/ocr/courses_desc.cfm?cn=STOP<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">PDA Seizure Forensic Course<br>Jun 14-16, Minneapolis, MN<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_32&products_id=335</td></tr>
+
<tr><td class="events">Advanced SMART Linux Data Forensics Training<br>Jun 19-22, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">Basic Data Recovery and Aquisition-BDRA<br>Jun 19-23, Pueblo, CO (Pueblo County Sheriffs Office)<br>http://nw3c.org/ocr/courses_desc.cfm?cn=BDRA<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">The Investigation of Computer Crime <br>Jun 19-23, Sacramento, CA<br>http://www.search.org/programs/hightech/calendar.asp<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">CCE Bootcamp<br>Jun 19-23, Cyber Crime Institute at Kennesaw State University, Kennesaw, GA<br>http://www.cce-bootcamp.com</td></tr>
+
<tr><td class="events">Introductory MacIntosh Forensics<br>Jun 19-23, Santa Clara, CA<br>http://www.blackbagtech.com/trainingintroductory.html</td></tr>
+
<tr><td class="events">Anti-Hacking Certificate Class<br>Jun 19-23, McLean, VA<br>http://www.securityuniversity.net/classes_anti-hacking.php</td></tr>
+
<tr><td class="events">CEH Ethical Hacking Certification Class<br>Jun 19-23, Sunnyvale, CA<br>http://www.securityuniversity.net/classes_CEH.php</td></tr>
+
<tr><td class="events">Professional Hacking Business Class<br>Jun 19-23, NYC, NY<br>http://www.vigilar.com/training_professional_hacking.html</td></tr>
+
<tr><td class="events">Advanced Penetration Testing: ECSA Boot Camp<br>Jun 19-23, Dallas, TX<br>http://www.vigilar.com/training_advanced_penetration.html</td></tr>
+
<tr><td class="events">Cyber Counterterrorism Investigations Training Program (CCITP)<br>Jun 19-28, FLETC, Glynco, GA<br>http://www.fletc.gov/cfi/fy06tibsched.htm<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">AccessData BootCamp<br>Jun 20-22, San Jose, CA and Frankfurt, Germany<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Jun 20-22, Burlington, MA and Omaha, NE<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Jun 20-23, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Jun 20-23, Chicago, IL, Houston, TX, Los Angeles, CA and Washington, DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Introduction to Computer Forensics<br>Jun 20-23, Houston, TX and Sydney, Australia<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase NTFS I : NTFS Artifacts and File Systems<br>Jun 20-23, United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase NTFS II : Windows Networking Investigations<br>Jun 26-29, United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Basic On-line Technical Skills-BOTS<br>Jun 26-30, Miami, FL (Florida Department of Law Enforcement (FDLE))<br>http://nw3c.org/ocr/courses_desc.cfm?cn=BOTS<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">ILook<br>Jun 26-30, Tulsa, OK<br>http://nw3c.org/ocr/courses_desc.cfm?cn=ILook%C2%AE<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Advanced Penetration Testing: ECSA Boot Camp<br>Jun 26-30, NYC, NY<br>http://www.vigilar.com/training_advanced_penetration.html</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Jun 27-30, Houston, TX and Los Angles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Advanced Internet Examinations<br>Jun 27-30, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Field Intelligence Model/Mobile EE Live Network Investigations - Phase I<br>Jun 27-30, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Jun 27-30, Centennial, CO and Houston, TX<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Network Intrusion Investigations - Phase I<br>Jun 27-30, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">PDA Seizure Forensic Course<br>Jul 03-05, Australia<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_32&products_id=329</td></tr>
+
<tr><td class="events">EnCase Essentials<br>Jul 04-07, United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Introduction to Internet Crime Investigations <br>Jul 06, Sacramento, CA<br>http://www.search.org/programs/hightech/calendar.asp<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Cell Seizure Forensic Course<br>Jul 06-07, Australia<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_29&products_id=330</td></tr>
+
<tr><td class="events">PDA Seizure Forensic Course<br>Jul 10-12, United Kingdom<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_32&products_id=327</td></tr>
+
<tr><td class="events">E-mail Analysis & Reporting<br>Jul 10-12, Australia<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_40&products_id=331</td></tr>
+
<tr><td class="events">Wireless Forensic Storage<br>Jul 10-12, Chicago, IL<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_41&products_id=248</td></tr>
+
<tr><td class="events">SMART Linux Data Forensics Training<br>Jul 10-13, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">Basic Local Area Network (LAN) Investigation <br>Jul 10-14, Sacramento, CA<br>http://www.search.org/programs/hightech/calendar.asp<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Applied Computer Forensics Boot Camp<br>Jul 10-14 , Las Vegas, NV<br>http://www.vigilar.com/training_cce.html?mc=ggaw_Forensics_training</td></tr>
+
<tr><td class="events">ILook <br>Jul 10-14, Pullman, WA<br>http://nw3c.org/ocr/courses_desc.cfm?cn=ILook%C2%AE<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Digital Evidence Acquisition Specialist Training Program (DEASTP)<br>Jul 10-21, FLETC, Glynco, GA<br>http://www.fletc.gov/cfi/fy06tibsched.htm<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">AccessData BootCamp<br>Jul 11-13, Los Angeles/El Segundo, CA<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Jul 11-13, Washington, DC<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Enterprise - Phase I<br>Jul 11-14, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Jul 11-14, Austin, TX, Los Angeles, CA and United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Introduction to Computer Forensics<br>Jul 11-14, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Network Intrusion Investigations - Phase I<br>Jul 11-14, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Professional Hacking Business Class<br>Jul 11-15, Philadelphia, PA<br>http://www.vigilar.com/training_professional_hacking.html</td></tr>
+
<tr><td class="events">Cell Seizure Forensic Course<br>Jul 13-14, United Kingdom<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_29&products_id=328</td></tr>
+
<tr><td class="events">Cell Seizure Advanced Forensics<br>Jul 17-19, Green Bay, WI<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_29&products_id=332</td></tr>
+
<tr><td class="events">Basic Data Recovery and Aquisition-BDRA<br>Jul 17-21, Orlando, FL (Florida Department of Law Enforcement (FDLE))<br>http://nw3c.org/ocr/courses_desc.cfm?cn=BDRA<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Anti-Hacking for Network Penetration Testing ECSA<br>Jul 17-21, McLean, VA<br>http://www.securityuniversity.net/classes_anti-hacking_pentest.php</td></tr>
+
<tr><td class="events">Applied Computer Forensics Business Boot Camp<br>Jul 17-21 , Norman, OK<br>http://www.vigilar.com/training_cce.html?mc=ggaw_Forensics_training</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Jul 18-20, Portland, OR<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Jul 18-21, United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Advanced Internet Examinations<br>Jul 18-21, Austin, TX<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Essentials<br>Jul 18-21, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Jul 18-21, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase NTFS I : NTFS Artifacts and File Systems<br>Jul 18-21, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Network Exploitation Analysis Training Program (NEATP)<br>Jul 18-27, FLETC, Glynco, GA<br>http://www.fletc.gov/cfi/fy06tibsched.htm<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">SIM Card Seizure Advanced Forensics<br>Jul 20-21, Green Bay, WI<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_44&products_id=333</td></tr>
+
<tr><td class="events">Advanced SMART Linux Data Forensics Training<br>Jul 24-27, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">EnCase NTFS II : Windows Networking Investigations<br>Jul 24-27, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Microsoft Network Forensics<br>Jul 24-28, Orlando, FL<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_30&products_id=334</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Jul 25-28, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Jul 25-28, Los Angeles, CA and United Kingdom<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Seized Computer Evidence Recovery Specialist Training Program (SCERS)<br>Jul 31-Aug 11, FLETC, Glynco, GA<br>http://www.fletc.gov/cfi/fy06tibsched.htm<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Aug 01-04, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Aug 01-04, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Cell Seizure Forensic Course<br>Aug 03-04, Redlands, CA<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_29&products_id=339</td></tr>
+
<tr><td class="events">Secure Techniques for Onsite Preview-STOP<br>Aug 07-08, Jacksonville, FL (Florida Department of Law Enforcement (FDLE))<br>http://nw3c.org/ocr/courses_desc.cfm?cn=STOP<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">PDA Seizure Forensic Course<br>Aug 07-09, Redlands, CA<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_32&products_id=303</td></tr>
+
<tr><td class="events">SMART Linux Data Forensics Training<br>Aug 07-10, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Aug 08-10, St. Louis/Ballwin, MO<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Advanced Internet Examinations<br>Aug 08-11, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Field Intelligence Model/Mobile EE Live Network Investigations - Phase I<br>Aug 08-11, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Secure Techniques for Onsite Preview-STOP<br>Aug 09-10, Jacksonville, FL (Florida Department of Law Enforcement (FDLE))<br>http://nw3c.org/ocr/courses_desc.cfm?cn=STOP<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">EnCase Field Intelligence Model/Mobile EE Live Network Investigations - Phase II<br>Aug 14-17, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Certified Wireless Analyst Professional CWAP<br>Aug 14-18, Sunnyvale, CA<br>http://www.securityuniversity.net/classes_wireless_CWAP.php</td></tr>
+
<tr><td class="events">ILook <br>Aug 14-18, Pueblo, CO<br>http://nw3c.org/ocr/courses_desc.cfm?cn=ILook%C2%AE<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">AccessData BootCamp<br>Aug 15-17, New York, NY<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Essentials<br>Aug 15-18, Los Angeles, CA and Washington, DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Aug 15-18, Sydney, Australia<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Paraben's P2 Forensic Fundamentals<br>Aug 16-18, Dallas, TX<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=320</td></tr>
+
<tr><td class="events">Certified Wireless Network Administrator CWNA<br>Aug 19-21, McLean, VA<br>http://www.securityuniversity.net/classes_wireless_CWAP.php</td></tr>
+
<tr><td class="events">Advanced SMART Linux Data Forensics Training<br>Aug 21-24, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">NetAnalysis<br>Aug 21-23, Dallas, TX<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_37&products_id=291</td></tr>
+
<tr><td class="events">Intermediate MacIntosh Forensics<br>Aug 21-25, Santa Clara, CA<br><a href="http://www.blackbagtech.com/trainingintermediate.html", http://www.blackbagtech.com/trainingintermediate.html</td></tr>
+
<tr><td class="events">CEH Ethical Hacking Certification Class<br>Aug 21-25, McLean, VA<br>http://www.securityuniversity.net/classes_CEH.php</td></tr>
+
<tr><td class="events">Cyber Counterterrorism Investigations Training Program (CCITP)<br>Aug 21-30, FLETC, Glynco, GA<br>http://www.fletc.gov/cfi/fy06tibsched.htm<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Aug 22-24, Philadelphia, PA<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">Certified Wireless Security Professional CWSP<br>Aug 22-25, McLean, VA<br>http://www.securityuniversity.net/classes_wireless_CWSP.php</td></tr>
+
<tr><td class="events">EnCase Field Intelligence Model/Mobile EE Live Network Investigations - Phase I<br>Aug 22-25, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Aug 22-25, Los Angeles, CA and Washington, DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Computer Network Investigations Training Program (CNITP)<br>Aug 22-Sep 01, FLETC, Glynco, GA<br>http://www.fletc.gov/cfi/fy06tibsched.htm<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">EnCase Field Intelligence Model/Mobile EE Live Network Investigations - Phase II<br>Aug 28-31, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Aug 29-Sep 01, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Advanced Internet Examinations<br>Aug 29-Sep 01, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Aug 29-Sep 01, Los Angeles, CA and Toronto, Canada<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">SMART Linux Data Forensics Training<br>Sep 04-07, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">EnCase Advanced Internet Examinations<br>Sep 05-08, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Sep 05-08, Melbourne, Australia<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Network Intrusion Investigations - Phase I<br>Sep 05-08, The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">CEH Ethical Hacking Certification Class<br>Sep 11-14, Sunnyvale, CA<br>http://www.securityuniversity.net/classes_CEH.php</td></tr>
+
<tr><td class="events">Windows Client Email Data Structures-EMAIL<br>Sep 11-15, Miami, FL (Florida Department of Law Enforcement (FDLE))<br>http://nw3c.org/ocr/courses_desc.cfm?cn=EMAIL<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Sep 12-15, Centennial, CO and The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Enterprise - Phase I<br>Sep 12-15, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Essentials<br>Sep 12-15, Los Angeles, CA and Washington, DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Sep 12-15, Toronto, Canada<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Network Intrusion Investigations - Phase I<br>Sep 12-15, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">E-mail Analysis & Reporting<br>Sep 13-14, Richmond, VA<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">Cell Seizure Advanced Forensics<br>Sep 18-20, Clovis, CA<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">Advanced SMART Linux Data Forensics Training<br>Sep 18-21, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">EnCase Enterprise - Phase II<br>Sep 18-21, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Network Intrusion Investigations - Phase II<br>Sep 18-21, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Sep 19-21, Frankfurt, Germany-auf DEUTSCH<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase EnScript Programming - Phase I<br>Sep 19-22, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Sep 19-22, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase NTFS I : NTFS Artifacts and File Systems<br>Sep 19-22, The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Cell Seizure Forensic Course<br>Sep 21-22, Hawaii<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">PDA Seizure Forensic Course<br>Sep 25-27, Hawaii<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">EnCase NTFS II : Windows Networking Investigations<br>Sep 25-28, The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Linux Forensics<br>Sep 25-29, Philadelphia, PA<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Sep 26-29, Washington, DC and Sydney, Australia<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Sep 26-29, Los Angeles, CA and Washington, DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Oct 03-05, San Jose, CA<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData Internet Forensics<br>Oct 03-05, Washington, DC<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Oct 03-06, The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">SMART Linux Data Forensics Training<br>Oct 09-12, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">Applied Computer Forensics Business Boot Camp<br>Oct 09-13 , Norman, OK<br>http://www.vigilar.com/training_cce.html?mc=ggaw_Forensics_training</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Oct 10-12, Austin, TX<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData BootCamp<br>Oct 10-12, New York, NY<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Field Intelligence Model/Mobile EE Live Network Investigations - Phase I<br>Oct 10-13, The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">PDA Seizure Forensic Course<br>Oct 16-18, Birmingham, AL<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">EnCase Field Intelligence Model/Mobile EE Live Network Investigations - Phase II<br>Oct 16-19, The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Basic Data Recovery and Aquisition-BDRA<br>Oct 16-20, Jacksonville, FL (Florida Department of Law Enforcement (FDLE))<br>http://nw3c.org/ocr/courses_desc.cfm?cn=BDRA<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">ILook <br>Oct 16-20, Lanham, MD<br>http://nw3c.org/ocr/courses_desc.cfm?cn=ILook%C2%AE<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Advanced MacIntosh Forensics<br>Oct 16-20, Santa Clara, CA<br>http://www.blackbagtech.com/trainingadvanced.html</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Oct 17-19, Los Angeles/El Segundo, CA<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Oct 17-20, Victoria, B.C.<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Advanced SMART Linux Data Forensics Training<br>Oct 23-26, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">AccessData BootCamp<br>Oct 24-26, Burlington, MA<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Advanced Internet Examinations<br>Oct 24-27, Toronto, Canada<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Cell Seizure Forensic Course<br>Oct 26-27, Nashville, TN<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">EnCase NTFS I : NTFS Artifacts and File Systems<br>Oct 31- Nov 03, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Wireless Forensic Storage<br>Nov 01-03, Atlanta, GA<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">NetAnalysis<br>Nov 06-08, Washington, D.C.<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">Advanced Data Recovery and Analysis, Internet Trace Evidence-ADRA-INET<br>Nov 06-09, Orlando, FL (Florida Department of Law Enforcement (FDLE))<br>http://nw3c.org/ocr/courses_desc.cfm?cn=INET<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">SMART Linux Data Forensics Training<br>Nov 06-09, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">EnCase NTFS II : Windows Networking Investigations<br>Nov 06-09, Washington DC<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Nov 06-10, Geneva, Switzerland<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">AccessData Internet Forensics<br>Nov 07-09, Chicago, IL<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Nov 07-10, Austin, TX and Toronto, Canada<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Network Intrusion Investigations - Phase I<br>Nov 07-10, The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">PDA Seizure Forensic Course<br>Nov 13-15, Spain<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">Microsoft Network Forensics<br>Nov 13-17, Las Vegas, NV<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Nov 14-16, Denver, CO<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Introduction to Computer Forensics<br>Nov 14-17, Melbourne, Australia<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Cell Seizure Forensic Course<br>Nov 16-17, Spain<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">Advanced SMART Linux Data Forensics Training<br>Nov 20-23, Austin, TX<br>http://www.asrdata.com/training/training2.html</td></tr>
+
<tr><td class="events">AccessData BootCamp<br>Nov 20-22, Redwood City, CA<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Nov 28-30, St. Paul, MN<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData BootCamp<br>Nov 28-30, Stockholm, Sweden<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase Advanced Computer Forensics<br>Nov 28-Dec 01, Melbourne, Australia<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">EnCase Network Intrusion Investigations - Phase I<br>Nov 28-Dec 01, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Basic Data Recovery and Aquisition-BDRA<br>Dec 04-08, Tallahassee, FL (Florida Department of Law Enforcement (FDLE))<br>http://nw3c.org/ocr/courses_desc.cfm?cn=BDRA<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">Paraben Forensics - Advanced<br>Dec 04-08, Washington, D.C.<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Dec 05-07, Dallas/Addison, TX<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">EnCase NTFS I : NTFS Artifacts and File Systems<br>Dec 05-08, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">PDA Seizure Forensic Course<br>Dec 06-08, Ohio<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">EnCase NTFS II : Windows Networking Investigations<br>Dec 11-14, Los Angeles, CA<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">ILook <br>Dec 11-15, Springdale, AR<br>http://nw3c.org/ocr/courses_desc.cfm?cn=ILook%C2%AE<br><b>Limited to Law Enforcement</b></td></tr>
+
<tr><td class="events">EnCase Intermediate Analysis and Reporting<br>Dec 12-15, The Netherlands<br>http://www.guidancesoftware.com/training/schedule.asp</td></tr>
+
<tr><td class="events">Cell Seizure Forensic Course<br>Dec 14-15, Minneapolis, MN<br>http://www.paraben-forensics.com/catalog/product_info.php?cPath=28_36&products_id=220</td></tr>
+
<tr><td class="events">AccessData BootCamp<br>Dec 18-20, Washington, DC<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData BootCamp<br>Dec 27-29, New York, NY<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData Windows Forensics<br>Dec 27-29, New York, NY<br>http://www.accessdata.com/training</td></tr>
+
<tr><td class="events">AccessData Internet Forensics<br>Dec 27-29, New York, NY<br>http://www.accessdata.com/training</td></tr>
+
</table>
+

Revision as of 22:22, 28 November 2013

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Contents

File format

The gzip file (.gz) format consists of:

  • a file header
  • optional headers
    • extra fields
    • original file name
    • comment
    • header checksum
  • a body, containing a DEFLATE-compressed payload
  • a file footer

The gzip format uses little-endian.

Offset Characteristics Description
Byte order little-endian
Date and time values Filetime in UTC
Character string ISO 8859-1 (LATIN-1)

File header

The file header is 10 bytes in size and contains:

Offset Size Value Description
0 2 0x1f 0x8b Signature (or identification byte 1 and 2)
2 1 Compression Method
3 1 Flags
4 4 Last modification time
Contains a POSIX timestamp.
8 1 Extra flags
9 1 Operating system
Value that indicates on which operating system the gzip file was created.

Compression method

Value Identifier Description
0 - 7 Reserved
8 "deflate" zlib compressed data

Flags

Value Identifier Description
0x01 FTEXT If set the uncompressed data needs to be treated as text instead of binary data.
This flag hints end-of-line conversion for cross-platform text files but does not enforce it.
0x02 FHCRC The file contains a header checksum (CRC-16)
0x04 FEXTRA The file contains extra fields
0x08 FNAME The file contains an original file name string
0x10 FCOMMENT The file contains comment
0x20 Reserved
0x40 Reserved
0x80 Reserved

Note: The FHCRC bit was never set by versions of gzip up to 1.2.4, even though it was documented with a different meaning in gzip 1.2.4.

Extra flags

If compression method is 8 the following extra flags can be defined:

Value Identifier Description
0x02 compressor used maximum compression, slowest algorithm
0x04 compressor used fastest algorithm

Operating System

Value Identifier Description
0 FAT filesystem (MS-DOS, OS/2, NT/Win32)
1 Amiga
2 VMS (or OpenVMS)
3 Unix
4 VM/CMS
5 Atari TOS
6 HPFS filesystem (OS/2, NT)
7 Macintosh
8 Z-System
9 CP/M
10 TOPS-20
11 NTFS filesystem (NT)
12 QDOS
13 Acorn RISCOS
255 unknown

Optional headers

Extra fields

TODO: add description

The extra field are variable of size and contains:

Offset Size Value Description
0 2 Extra field data size
Value in bytes.
2 ... Extra field data

Original file name

This is the original name of the file being compressed, with any directory components removed, and, if the file being compressed is on a file system with case insensitive names, forced to lower case.

Contains an ISO 8859-1 (LATIN-1) string with end-of-string character.

Comment

Contains an ISO 8859-1 (LATIN-1) string with end-of-string character. Line breaks should be denoted by a single line feed character.

Header checksum

The header checksum contain a CRC-16 that consists of the two least significant bytes of the CRC-32 for all bytes of the gzip header up to and not including the CRC-16.

File footer

The file footer is 8 bytes in size and contains:

Offset Size Value Description
0 4 Checksum (CRC-32)
4 4 Uncompressed data size
Value in bytes.

See Also

External Links