DF210 - Building an Investigation with EnCase is a 4-day intermediate-level training course designed for investigators with prior computer forensics training and experience using OpenText EnCase software. The course builds upon skills from the DF120 Foundations course and focuses on advanced investigation techniques. The training covers analysis methods including recovering deleted volumes, registry analysis, Recycle Bin examination, and compound file analysis. Students learn to search unallocated clusters, parse Windows artifacts, examine email and Internet artifacts, and analyze USB device artifacts. The course provides hands-on instruction on identifying and opening BitLocker encrypted volumes, locating and recovering deleted partitions, determining time zone offsets, creating and using conditions for effective searching, and understanding ExFAT and NT file systems. Additional topics include examining shortcut files, recovering data from removable USB devices, conducting email searches, employing GREP operators, recovering print spooler artifacts, using the EnCase Physical Disk Emulator Module, and creating investigation reports. Prerequisites include completion of DF120 - Foundations in Digital Forensics. The course awards 32 CPE credits and is delivered through group-live instruction. The target audience includes cybersecurity professionals, litigation support staff, and forensic investigators.