PC Forensics / Advanced Investigations

Course Description - This 80-hour course is designed to provide investigators of high technology and/or computer crimes with training on tools and procedures for conducting difficult and detailed forensic examinations of personal computers and seized digital media. Students will also learn how to build their own forensic analysis computer, troubleshoot and repair problems with their computers, and become familiar with advanced capabilities of tools available to the forensic analyst. The course consists of lecture, hands on classroom exercises and 32 to 44 hours of lab work.

Who Should Attend - Peace officers assigned to a computer crime unit or task force who are, or will be required to conduct computer forensic examinations of seized digital evidence.

Pre-requisites - Students must have completed the ATC's Computer Evidence Recovery and Analysis (C.E.R.A.) class and the Specialized Tools class.

NOTE: Successful completion of a pre-test, to judge the students skills and knowledge on computer crime investigation and computer operations, will be required prior to admission to this course. The test will also give the prospective students insight to the level of training presented in this course.

Course Objectives - Upon completion of this class, students will have the knowledge necessary to build a forensic computer, troubleshoot and repair problems with their forensic computer, be aware of advanced capabilities of software tools available for forensic analysis, have used some of the more popular tools, and be able to properly and effectively develop, analyze and present for prosecution, a digital evidence case.

Course Outline

• Laws Relative to Search Warrants and Recovery of Digital Evidence
• How to Build and Trouble-Shoot an Efficient Forensic Analysis Computer
• Available Analysis Tools for Recovery of Digital Evidence
• Preservation, Recovery and Examination of Digital Evidence
• Limiting Forensic Analysis to Case Needs
• Reporting Evidence Discovered in Digital Format
• Discovery Issues (contraband, instruments, etc.)
• Lab Work and Case Exercises

Additional Information - For further information contact the ATC at C(916) 464-1200, and ask for the Program Training Officer or Secretary for this course.