PC Forensics / Data Collection

Course Description - This 28-hour course is designed for criminal investigators, prosecutors, or support staff whose duties include investigation and prosecution of high-technology crimes and the seizure of electronic evidence. Students will learn the fundamentals of computer operations and hardware function, and how to protect, preserve and image digital evidence. This class will introduce students to the unique skills, best practices and methodologies necessary to assist in the investigation and prosecution of computer crimes. The course consists of lectures, presentations and hands-on classroom exercises on such topics as partitioning, formatting, data storage, hardware and software write blockers, the boot up process, and duplicate Imaging.

Who Should Attend - Peace officers, criminal investigators, prosecutors, or support staff assigned to a computer crime unit or task force who are, or will be required to conduct computer forensic examinations of seized digital evidence. Students must already possess a good understanding of computers and common software applications. The course utilizes common computer forensic applications, currently used in the field by experienced practitioners. In addition, knowledge of basic DOS commands is essential.

Pre-requisites - Students must have completed the Advanced Training Center’s Computer/High Technology Investigation and Computer Crime/Investigation of Internet Crimes courses and successfully pass DOS Command pre-test.

NOTE: Enrollment for this course is not done through the ATC. You must enroll with NW3C by visiting the following link: http://www.nw3c.com/ocr/courses_desc.cfm?cn=BDRA. Select the date and location of your choice and you will be prompted for enrollment. Successful completion of a pre-test, to judge the student’s skills and knowledge on computer crime investigation and computer operations, will be required prior to admission to this course. The test will also give the prospective students insight to the level of training presented in this course.

Course Objectives - Upon completion of this class, students will have the knowledge necessary to seize and image digital evidence correctly, be aware of advanced capabilities of software tools available for forensic analysis, have used some of the more popular tools, and be able to properly and effectively develop, analyze and present for prosecution, a digital evidence case.

Course Outline

• How computers store data
• Files, logs, and tables created by modern operating systems
• How to correctly seize digital evidence
• Imaging digital evidence
• Available analysis tools for recovery of digital evidence
• Preservation of recovered digital evidence
• Examination of recovered digital evidence
• Limiting Forensic Analysis to case needs
• Discovery Issues (contraband, instruments, etc.)
• Lab Work and Case Exercises

Additional Information - For further information, contact the ATC at (916) 464-1200, and ask for the Program Training Manager or Secretary for this course.