Last weeks Training

Last week I spent 2 days in a Cyber Security Investigations class from the Software Engineering Institute | Carnegie Mellon University.  Im pretty sure CERT was responsible for putting on the class.  It was a basic course on Digital Forensics.   The teacher went over a variety of topics even including attack vectors and offensive tools that attackers could use.  Most of the time was spent talking about strategy, and where to look for logs, clues and other trails that attackers leave when they penetrate a network.  My favorite part of the class was a presentation using FTK Imager to do data carving of unallocated space on a hard drive.  He pulled off a JPG using the known start and stop bits of a JPG file.   Im not sure if i'll ever need that knowledge for work but it was very good information incase I ever needed to.    Some programs I've used in the past can pull deleted files off of a hard drive and Im wondering if they work in the same way, looking for start and stop bits of files.