Computer Digital Evidence Recovery

Course Description - This 80-hour course is designed for investigators who have basic computer skills and are new to the field of computer forensics. This class will provide training on: forensic computer components; set-up and trouble shooting of forensic hardware and software; case management; understanding the fundamentals of a search warrant; search and seizure of computer/digital evidence; tools, skills and protocols necessary to assist in the forensic investigation and prosecution of a computer crime.

Who Should Attend - Investigators who are currently assigned, or will soon be assigned, to perform forensic investigations on digital evidence.

NOTE: Successful completion of a pre-test, to judge the students skills and knowledge on computer crime investigation and computer operations, will be required prior to admission to this course. It will also give the prospective students insight to the level of training presented in this course.

Course Objectives - This is a hands-on course that involves practical exercises which are designed to simulate criminal situations and test the student’s ability to complete a successful forensic investigation on digital evidence.

Course Outline

• Understanding of Computer Forensics
• Fundamentals of Computer Hardware
• Working a Case from the Beginning to the Final Report
• Conducting Basic Searches and Analysis of Evidence
• Overview of Forensics Software
• Legal Update
• Writing Effective Search Warrants
• Preparing Evidence for Presentation in Court
• Understanding File Systems
• Evidence Identification
• Removal, Recovery, and Accessing Digital Media
• Understanding Fundamentals of Write Blocking

Additional Information - For further information, contact the Advanced Training Center at (916) 464-1200, and ask for the Program Training Manager or Secretary for this course.