published by madridj on Mon, 09/17/2012 - 12:49
Class Location:
California Criminalistics Institute / Rancho Cordova and various
Class Description:
This 80-hour course is designed for investigators who have basic computer skills and are new to computer forensics. This class will provide training on: forensic computer components; set-up and trouble shooting of forensic hardware and software; case management; understanding the fundamentals of a search warrant; search and seizure of computer/digital evidence; tools, skills and protocols necessary to assist in the forensic investigation and prosecution of a computer crime.
The course includes:
Understanding of computer forensics;
Fundamentals of computer hardware;
Working a case from the beginning to the final report;
Conducting basic searches and analysis of evidence;
Overview of forensics software;
Legal update;
Writing effective search warrants;
Preparing evidence for presentation in court;
Understanding file systems;
Evidence identification;
Removal, recovery, and accessing digital media,
Understanding fundamentals of write blocking
Teaching Methods:
Lecture, hands-on practical exercises.
Objectives:
Course exercises are designed to simulate criminal situations and test the student’s ability to complete a successful forensic investigation on digital evidence.
Prerequisites:
Successful completion of a pre-test, to judge student skills and knowledge on computer crime investigation and computer operations, will be required prior to admission to this course. It will also give the prospective students insight to the level of training presented in this course.
Tuition:
There is no cost to local law enforcement agencies. DOJ and local Crime Laboratory employees who qualify for this class must pay $3,261 for registration and materials.
Program Manager:
- CCI at (916) 464-0600, FAX (916) 464-5818
published by madridj on Mon, 09/17/2012 - 12:24
Class Location:
California Criminalistics Institute / Rancho Cordova
Class Description:
This 36-hour course is designed to provide law enforcement personnel with foundation skills for the investigation of computer related crimes. Special circumstances arise and special consideration has to be given when a computer is used as an instrument of crime, when a computer is the target of criminal activity or when a computer contains records of criminal activity.
The course includes:
Using a computer to commit a crime;
Records of criminal activity on computers;
How computers work and store data;
Seizures of computer crime evidence;
Working with a computer forensic specialist;
Writing search warrants for high tech crimes;
Specialized legal problems with electronic data and equipment,
Resources to assist investigations
Teaching Methods:
Lecture, hands-on exercises.
Objectives:
Students will have the knowledge to investigate crimes committed by use of computers and seize computers used in criminal activity.
Prerequisites:
Students should be law enforcement personnel assigned to high technology crime investigation units, white collar crime units, fraud or forgery units, identity theft units as well as individuals whose primary responsibility is to seize computer evidence/equipment discovered at crime scenes. Students must have a working knowledge of computer operating systems and simple operations (word processing, spreadsheets, copy files, etc.) before enrolling in this class. This class will be directed at individuals already in possession of these skills. No class time will be devoted to developing these skills in the students.
Tuition:
There is no cost to local law enforcement agencies. DOJ and local Crime Laboratory employees who qualify for this class must pay $512 for registration and materials.
published by madridj on Mon, 09/17/2012 - 12:17
Class Description:
This 40-hour course is designed to provide investigators with the necessary training, skills, knowledge and practical experience to conduct on-line crime investigations. Instruction will also be provided on using the internet as an investigative tool including: internet protocols; LAN/WAN/GAN operations; e-mail tracing; and social networking sites as investigative resources.
The course includes:
Components of the internet;
How the internet works;
Laws relative to on-line investigations;
Review of crimes committed on the Internet;
E-mail and IP tracing;
IRC, FTP, and Newsgroups;
Overview of social networking sites,
Detection and prevention of internet crimes
Teaching Methods:
Lecture, hands-on assignments and laboratory practice.
Objectives:
Students will understand crimes committed on the internet, use of the internet as an investigative tool, be able to conduct reactive and proactive investigations on the internet, and be able to use basic tools to gather evidence on the internet. Additionally, students will learn state and federal laws applicable to internet crimes and who to contact for additional resources to aid their investigations.
Prerequisites:
Students should be law enforcement personnel assigned to high technology crime investigation units, white collar crime units, fraud or forgery units, sex and vice crimes units. Additionally, any law enforcement officers with an interest in internet crime investigations may attend. Students should have the ability to effectively operate a computer in the Windows environment.
Tuition:
There is no cost to local law enforcement agencies. DOJ and local Crime Laboratory employees who qualify for this class must pay $1,229 for registration and materials.
Program Manager:
- CCI at (916) 464-0600, FAX (916) 464-5818
published by madridj on Mon, 09/17/2012 - 12:11
Class Location:
California Criminalistics Institute / Rancho Cordova
Class Description:
This 28-hour course is designed for criminal investigators, prosecutors, or support staff whose duties include investigation and prosecution of high-technology crimes and the seizure of electronic evidence. Students will learn the fundamentals of computer operations and hardware function, and how to protect, preserve, and image digital evidence. This class will introduce students to the unique skills, best practices and methodologies necessary to assist in the investigation and prosecution of computer crimes, on such topics as partitioning, formatting, data storage, hardware and software write blockers, the boot up process, and duplicate imaging.
Teaching Methods:
Lectures, presentations, and hands-on classroom exercises
Objectives:
Students will have the knowledge necessary to seize and image digital evidence correctly, be aware of advanced capabilities of software tools available for forensic analysis, have used some of the more popular tools, and be able to properly and effectively develop, analyze and present for prosecution, a digital evidence case.
Prerequisites:
Completion of D100 Computer Crime-High Technology Investigation and D200 Computer Crime-Investigation of Internet Crimes courses and successfully pass DOS Command pre-test.
Preparation:
Students should be peace officers, criminal investigators, prosecutors, or support staff assigned to a computer crime unit or task force who are, or will be required to conduct computer forensic examinations of seized digital evidence. Students must already possess a good understanding of computers and common software applications.
Program Manager:
- CCI at (916) 464-0600, FAX (916) 464-5818
published by madridj on Mon, 09/17/2012 - 11:46
Class Description:
This 40-hour course is designed to provide investigators with the training, skills, knowledge and practical experience in using some of the more advanced tools developed for computer forensics. Instruction will be provided on different tools each fiscal year.
The course includes:
The principles of how/why the tool was developed;
Imaging digital evidence;
How the tool verifies and ensures no changes to original evidence;
Setting up a forensic case;
Use of Hash and Signature analysis to limit area searched;
Word/text searching;
Boolean terms, GREP expressions and Scripts to increase search effectiveness,
Creating a report of results of investigation
Teaching Methods:
Lectures and hands-on activity.
Objectives:
Students will understand the functions and capabilities of the forensic tool. They will receive training and practice using the tool to conduct forensic investigations. The training will include how to make image files of digital evidence and how to verify that no changes were made to the evidence while conducting the investigation.
Prerequisites:
Completion of D300 Computer Digital Evidence Recovery. Students should be law enforcement personnel assigned to high technology crime investigation units, white collar crime units, fraud or forgery units, sex and vice crimes units with the assigned responsibility for computer forensic investigations.
Tuition:
There is no cost to local law enforcement agencies. DOJ and local Crime Laboratory employees who qualify for this class may pay $1,729 for registration and materials.
Program Manager:
- CCI at (916) 464-0600, FAX (916) 464-5818
published by madridj on Mon, 09/17/2012 - 11:38
Class Description:
This 80-hour course provides investigators of high technology and/or computer crimes with training on tools and procedures for conducting difficult and detailed forensic examinations of personal computers and seized digital media. Students will also learn how to build their own forensic analysis computer, troubleshoot and repair problems with their computers, and become familiar with advanced capabilities of tools available to the forensic analyst.
The course includes:
Laws relative to search warrants and recovery of digital evidence;
How to build and trouble-shoot an efficient forensic analysis computer;
Available analysis tools for recovery of digital evidence;
Preservation, recovery and examination of digital evidence;
Limiting forensic analysis to case needs;
Reporting evidence discovered in digital format;
Discovery issues (contraband, instruments, etc.),
Lab work and case exercises
Teaching Methods:
Lecture, hands-on classroom exercises, and 32 to 44 hours of laboratory work.
Objectives:
Students will have the knowledge necessary to build a forensic computer, troubleshoot and repair problems with their forensic computer, be aware of advanced capabilities of software tools available for forensic analysis, have used some of the more popular tools, and be able to properly and effectively develop, analyze and present for prosecution, a digital evidence case.
Prerequisites:
Completion of D300 Computer Digital Evidence Recovery and D310 PC Forensics - Specialized Tools.
Preparation:
Successful completion of a pre-test, to judge student skills and knowledge on computer crime investigation and computer operations, will be required prior to admission to this course. The test will also give the prospective students insight to the level of training presented in this course.
Program Manager:
- CCI at (916) 464-0600, FAX (916) 464-5818
published by madridj on Mon, 09/17/2012 - 11:28
Class Description:
This 40-hour course is designed to teach law enforcement investigators the principals of responding to and investigating network intrusion crimes. Students will create a Local Area Network (LAN), Wide Area Network (WAN), Global Area Network (GAN) and use them to study, explore, and understand how exploits and hacks of networked systems are committed.
Included in the course:
Network construction and operation;
In-depth examination of networking protocols;
Advanced investigative techniques;
Review of current network exploits;
Case analysis of network intrusions;
Legal update;
Resources;
Evidence handling,
Hands-on lab
Teaching Methods:
Lecture, hands-on activity.
Objectives:
Students will be able to plan and prepare for all stages of an advanced on-line investigation, including network intrusions, attacks on servers, proper evidence handling, hacker tools, investigative processes to assist with computer forensic investigations of network intrusions, and on-line surveillance of network activity. The student will be able to effectively communicate with the system administrator of a network.
Prerequisites:
Students should be assigned to conduct investigations of on-line criminal activity including network intrusions and denial of service attacks.
Program Manager:
- CCI at (916) 464-0600, FAX (916) 464-5818
More Information:
This course is made possible through funds provided by the Office of Emergency Services (OES).
published by madridj on Mon, 09/17/2012 - 11:20
Class Location:
California Criminalistics Institute / Rancho Cordova, various
Class Description:
This 40-hour course is designed to provide law enforcement personnel with foundational skills for forensic examination of cellular phones used as instruments of crime or when cellular phones contain records of criminal activity. These records can include phone book entries, call history, text messages, calendar entries, images, and videos.
Classes will include:
Basic understanding of cellular phones and cellular networks;
Description of a variety of tools (both hardware and software) available for extracting data from cellular phones;
Demonstrations of how different cellular phone forensic tools work;
Laws related to seizure and examination of cellular phones;
Hands on exercises for extracting data from cellular phones, SIM cards and flash media cards using a variety of different tools;
Basic understanding of SIM cards,
Techniques for isolating cellular phones from cellular networks
Teaching Methods:
Lecture, hands-on activities.
Objectives:
Upon completion of this course, students will have the ability to examine cellular phones and investigate crimes committed using cellular phones, as well as seize cellular phones used in criminal activity.
Prerequisites:
Students must have a working knowledge of computer operating systems and simple operations (word processing, spreadsheets, copy files, etc.) before enrolling in this class. No class time will be devoted to developing these skills in the students.
Preparation:
Students should be law enforcement personnel assigned to high technology crime investigation units, white collar crime units, fraud or forgery units, identity theft units as well as individuals whose primary responsibility is to seize computer evidence/equipment discovered at crime scenes.
Program Manager:
- CCI at (916) 464-0600, FAX (916) 464-5818
published by madridj on Mon, 09/17/2012 - 11:07
Class Description:
This 40-hour course is designed to give high tech-computer forensic investigators working knowledge of Apple devices, the Operating System, and conducting forensic examinations of Mac media. Students will learn how to navigate in and work with the Apple’s OS X and Linux environments.
Apple Computers supports the Mac OS and provides an environment to run Windows, Linux, and the UNIX-based Operating Systems. Because of this versatility, investigators are performing more forensic investigations on Apple computers.
Teaching Methods:
Lecture, hands-on exercises, instructor-led exercises, and self-paced lab work.
Objectives:
Students will build a foundation of understanding the Mac OS X, UNIX, and Linux operating system environments and hands-on experience in those environments. Students will use Mac laptops with the OS X operating system. The course will explain file system structure, operating system components, location of forensically relevant files and folders, examination and analysis, and a comparison of Mac- vs. Windows-based examinations.
Prerequisites:
Students must have completed D300 Computer Digital Evidence Recovery; D310 Specialized Tools; and D400 Advanced Forensics for the Investigator courses.
Preparation:
Students should be peace officers assigned to a computer crime unit/task force who are assigned responsibility for computer forensic investigations.
Program Manager:
- CCI at (916) 464-0600, FAX (916) 464-5818
