• Subscribe to the AG's RSS Feed
  • Join the AG's FaceBook
  • Follow the AG on Twitter
  • View the AG's YouTube Channel
  • View the AG's Tumblr Page

D - Digital Evidence

Computer Crimes Pre-Search

Class Code: 
D105

Subject Area:

Class Location: 
TBA
Class Description: 
This 16-hour course is designed to provide investigators, patrol officers, probation officers and parole officers with the basic skills, knowledge and practical experience to preliminarily examine digital media including personal computers and external storage devices. This class will introduce a variety of tools to assess computers and demonstrate how to examine them for potential evidence. This class is not designed to take the place of a full and proper forensic examination; however, it will help identify hardware that might yield evidence.
Instructor: 
TBA
Teaching Methods: 
Lecture, demonstration and hands-on exercises
Objectives: 
The course is designed to provide investigators, patrol officers, probation officers and parole officers with the basic skills, knowledge and practical experience to preliminarily examine digital media including personal computers and external storage devices.
Prerequisites: 
Previous experience with Microsoft Windows.
Materials Fee: 
No materials fee.
Tuition: 
No cost to POST-supported or State of California based law enforcement agencies. A tuition fee may be required of some public agency, private sector, or out-of-state applicants.
More Information: 

Training officer Martin Balcazar, 916-464-0460.

Computer Digital Evidence Recovery

Class Code: 
D300

Subject Area:

Class Location: 
California Criminalistics Institute / Rancho Cordova and various
Class Description: 
This 80-hour course is designed for investigators who have basic computer skills and are new to computer forensics. This class will provide training on: forensic computer components; set-up and trouble shooting of forensic hardware and software; case management; understanding the fundamentals of a search warrant; search and seizure of computer/digital evidence; tools, skills and protocols necessary to assist in the forensic investigation and prosecution of a computer crime. The course includes: Understanding of computer forensics; Fundamentals of computer hardware; Working a case from the beginning to the final report; Conducting basic searches and analysis of evidence; Overview of forensics software; Legal update; Writing effective search warrants; Preparing evidence for presentation in court; Understanding file systems; Evidence identification; Removal, recovery, and accessing digital media, Understanding fundamentals of write blocking
Instructor: 
Various
Teaching Methods: 
Lecture, hands-on practical exercises.
Objectives: 
Course exercises are designed to simulate criminal situations and test the student’s ability to complete a successful forensic investigation on digital evidence.
Prerequisites: 
Successful completion of a pre-test, to judge student skills and knowledge on computer crime investigation and computer operations, will be required prior to admission to this course. It will also give the prospective students insight to the level of training presented in this course.
Tuition: 
There is no cost to local law enforcement agencies. State or federal employees who qualify for this class must pay $3,261 for registration and materials.

Course Contact:

Computer Crime-High Technology Investigation

Class Code: 
D100

Subject Area:

Class Location: 
California Criminalistics Institute / Rancho Cordova
Class Description: 
This 36-hour course is designed to provide law enforcement personnel with foundation skills for the investigation of computer related crimes. Special circumstances arise and special consideration has to be given when a computer is used as an instrument of crime, when a computer is the target of criminal activity or when a computer contains records of criminal activity. The course includes: Using a computer to commit a crime; Records of criminal activity on computers; How computers work and store data; Seizures of computer crime evidence; Working with a computer forensic specialist; Writing search warrants for high tech crimes; Specialized legal problems with electronic data and equipment, Resources to assist investigations
Instructor: 
Various
Teaching Methods: 
Lecture, hands-on exercises.
Objectives: 
Students will have the knowledge to investigate crimes committed by use of computers and seize computers used in criminal activity.
Prerequisites: 
Students should be law enforcement personnel assigned to high technology crime investigation units, white collar crime units, fraud or forgery units, identity theft units as well as individuals whose primary responsibility is to seize computer evidence/equipment discovered at crime scenes. Students must have a working knowledge of computer operating systems and simple operations (word processing, spreadsheets, copy files, etc.) before enrolling in this class. This class will be directed at individuals already in possession of these skills. No class time will be devoted to developing these skills in the students.
Tuition: 
There is no cost to local law enforcement agencies. DOJ and local Crime Laboratory employees who qualify for this class must pay $512 for registration and materials.

Course Contact:

Computer Crime-Investigation of Internet Crimes

Class Code: 
D200

Subject Area:

Class Location: 
Various
Class Description: 
This 40-hour course is designed to provide investigators with the necessary training, skills, knowledge and practical experience to conduct on-line crime investigations. Instruction will also be provided on using the internet as an investigative tool including: internet protocols; LAN/WAN/GAN operations; e-mail tracing; and social networking sites as investigative resources. The course includes: Components of the internet; How the internet works; Laws relative to on-line investigations; Review of crimes committed on the Internet; E-mail and IP tracing; IRC, FTP, and Newsgroups; Overview of social networking sites, Detection and prevention of internet crimes
Instructor: 
Various
Teaching Methods: 
Lecture, hands-on assignments and laboratory practice.
Objectives: 
Students will understand crimes committed on the internet, use of the internet as an investigative tool, be able to conduct reactive and proactive investigations on the internet, and be able to use basic tools to gather evidence on the internet. Additionally, students will learn state and federal laws applicable to internet crimes and who to contact for additional resources to aid their investigations.
Prerequisites: 
Students should be law enforcement personnel assigned to high technology crime investigation units, white collar crime units, fraud or forgery units, sex and vice crimes units. Additionally, any law enforcement officers with an interest in internet crime investigations may attend. Students should have the ability to effectively operate a computer in the Windows environment.
Tuition: 
There is no cost to local law enforcement agencies. DOJ and local Crime Laboratory employees who qualify for this class must pay $1,229 for registration and materials.

Course Contact:

PC Forensics - Basic Data Collection

Class Code: 
D250

Subject Area:

Class Location: 
California Criminalistics Institute / Rancho Cordova or various
Class Description: 
This 28-hour course is designed for criminal investigators, prosecutors, or support staff whose duties include investigation and prosecution of high-technology crimes and the seizure of electronic evidence. Students will learn the fundamentals of computer operations and hardware function, and how to protect, preserve, and image digital evidence. This class will introduce students to the unique skills, best practices and methodologies necessary to assist in the investigation and prosecution of computer crimes, on such topics as partitioning, formatting, data storage, hardware and software write blockers, the boot up process, and duplicate imaging.
Instructor: 
Various
Teaching Methods: 
Lectures, presentations, and hands-on classroom exercises
Objectives: 
Students will have the knowledge necessary to seize and image digital evidence correctly, be aware of advanced capabilities of software tools available for forensic analysis, have used some of the more popular tools, and be able to properly and effectively develop, analyze and present for prosecution, a digital evidence case.
Prerequisites: 
None
Preparation: 
Students should be peace officers, criminal investigators, prosecutors, or support staff assigned to a computer crime unit or task force who are, or will be required to conduct computer forensic examinations of seized digital evidence. Students must already possess a good understanding of computers and common software applications.
Tuition: 
There is no cost to local law enforcement agencies. State or federal employees who qualify for this class must pay $3,261 for registration and materials.

Course Contact:

PC Forensics - Specialized Investigative Tools

Class Code: 
D310

Subject Area:

Class Location: 
Pasadena
Class Description: 
This 40-hour course is designed to provide investigators with the training, skills, knowledge and practical experience in using some of the more advanced tools developed for computer forensics. Instruction will be provided on different tools each fiscal year. The course includes: The principles of how/why the tool was developed; Imaging digital evidence; How the tool verifies and ensures no changes to original evidence; Setting up a forensic case; Use of Hash and Signature analysis to limit area searched; Word/text searching; Boolean terms, GREP expressions and Scripts to increase search effectiveness, Creating a report of results of investigation
Instructor: 
Guidance Software
Teaching Methods: 
Lectures and hands-on activity.
Objectives: 
Students will understand the functions and capabilities of the forensic tool. They will receive training and practice using the tool to conduct forensic investigations. The training will include how to make image files of digital evidence and how to verify that no changes were made to the evidence while conducting the investigation.
Prerequisites: 
Completion of D300 Computer Digital Evidence Recovery. Students should be law enforcement personnel assigned to high technology crime investigation units, white collar crime units, fraud or forgery units, sex and vice crimes units with the assigned responsibility for computer forensic investigations.
Tuition: 
There is no cost to local law enforcement agencies. State and federal employees who qualify for this class may pay $1,729 for registration and materials.

Course Contact:

PC Forensics - Advanced Computer Investigations, Build-a-Box

Class Code: 
D400

Subject Area:

Class Location: 
Various
Class Description: 
This 80-hour course provides investigators of high technology and/or computer crimes with training on tools and procedures for conducting difficult and detailed forensic examinations of personal computers and seized digital media. Students will also learn how to build their own forensic analysis computer, troubleshoot and repair problems with their computers, and become familiar with advanced capabilities of tools available to the forensic analyst. The course includes: Laws relative to search warrants and recovery of digital evidence; How to build and trouble-shoot an efficient forensic analysis computer; Available analysis tools for recovery of digital evidence; Preservation, recovery and examination of digital evidence; Limiting forensic analysis to case needs; Reporting evidence discovered in digital format; Discovery issues (contraband, instruments, etc.), Lab work and case exercises
Instructor: 
Various
Teaching Methods: 
Lecture, hands-on classroom exercises, and 32 to 44 hours of laboratory work.
Objectives: 
Students will have the knowledge necessary to build a forensic computer, troubleshoot and repair problems with their forensic computer, be aware of advanced capabilities of software tools available for forensic analysis, have used some of the more popular tools, and be able to properly and effectively develop, analyze and present for prosecution, a digital evidence case.
Prerequisites: 
Completion of D250 PC Forensics, Basic Data Collection; D300 Computer Digital Evidence Recovery, and D310 PC Forensics - Specialized Tools.
Preparation: 
Successful completion of a pre-test, to judge student skills and knowledge on computer crime investigation and computer operations, will be required prior to admission to this course. The test will also give the prospective students insight to the level of training presented in this course.

Course Contact:

Computer Crime - LAN Investigations

Class Code: 
D315

Subject Area:

Class Location: 
Various
Class Description: 
This 40-hour course is designed to teach law enforcement investigators the principals of responding to and investigating network intrusion crimes. Students will create a Local Area Network (LAN), Wide Area Network (WAN), Global Area Network (GAN) and use them to study, explore, and understand how exploits and hacks of networked systems are committed. Included in the course: Network construction and operation; In-depth examination of networking protocols; Advanced investigative techniques; Review of current network exploits; Case analysis of network intrusions; Legal update; Resources; Evidence handling, Hands-on lab
Instructor: 
Various
Teaching Methods: 
Lecture, hands-on activity.
Objectives: 
Students will be able to plan and prepare for all stages of an advanced on-line investigation, including network intrusions, attacks on servers, proper evidence handling, hacker tools, investigative processes to assist with computer forensic investigations of network intrusions, and on-line surveillance of network activity. The student will be able to effectively communicate with the system administrator of a network.
Prerequisites: 
Students should be assigned to conduct investigations of on-line criminal activity including network intrusions and denial of service attacks.

Course Contact:

More Information: 

This course is made possible through funds provided by the Office of Emergency Services (OES).

Cellular Phone Forensics/Investigations

Class Code: 
D320

Subject Area:

Class Location: 
California Criminalistics Institute / Rancho Cordova, various
Class Description: 
This 40-hour course is designed to provide law enforcement personnel with foundational skills for forensic examination of cellular phones used as instruments of crime or when cellular phones contain records of criminal activity. These records can include phone book entries, call history, text messages, calendar entries, images, and videos. Classes will include: Basic understanding of cellular phones and cellular networks; Description of a variety of tools (both hardware and software) available for extracting data from cellular phones; Demonstrations of how different cellular phone forensic tools work; Laws related to seizure and examination of cellular phones; Hands on exercises for extracting data from cellular phones, SIM cards and flash media cards using a variety of different tools; Basic understanding of SIM cards, Techniques for isolating cellular phones from cellular networks
Instructor: 
Various
Teaching Methods: 
Lecture, hands-on activities.
Objectives: 
Upon completion of this course, students will have the ability to examine cellular phones and investigate crimes committed using cellular phones, as well as seize cellular phones used in criminal activity.
Prerequisites: 
Students must have a working knowledge of computer operating systems and simple operations (word processing, spreadsheets, copy files, etc.) before enrolling in this class. No class time will be devoted to developing these skills in the students.
Preparation: 
Students should be law enforcement personnel assigned to high technology crime investigation units, white collar crime units, fraud or forgery units, identity theft units as well as individuals whose primary responsibility is to seize computer evidence/equipment discovered at crime scenes.

Course Contact:

Computer Forensics - Macintosh/Linux

Class Code: 
D425

Subject Area:

Class Location: 
various
Class Description: 
This 40-hour course is designed to give high tech-computer forensic investigators working knowledge of Apple devices, the Operating System, and conducting forensic examinations of Mac media. Students will learn how to navigate in and work with the Apple’s OS X and Linux environments. Apple Computers supports the Mac OS and provides an environment to run Windows, Linux, and the UNIX-based Operating Systems. Because of this versatility, investigators are performing more forensic investigations on Apple computers.
Instructor: 
Blackbag Technologies
Teaching Methods: 
Lecture, hands-on exercises, instructor-led exercises, and self-paced lab work.
Objectives: 
Students will build a foundation of understanding the Mac OS X, UNIX, and Linux operating system environments and hands-on experience in those environments. Students will use Mac laptops with the OS X operating system. The course will explain file system structure, operating system components, location of forensically relevant files and folders, examination and analysis, and a comparison of Mac- vs. Windows-based examinations.
Prerequisites: 
Students must have completed D300 Computer Digital Evidence Recovery; D310 Specialized Tools; and D400 Advanced Forensics for the Investigator courses.
Preparation: 
Students should be peace officers assigned to a computer crime unit/task force who are assigned responsibility for computer forensic investigations.

Course Contact:

Megan's Law

California Registered Sex Offender Database

Search Now

Megan's Law information is also available in these languages:

Site Navigation

Translate Website

  • Google™ Translation Disclaimer

This Google™ translation feature is provided for informational purposes only.

The Office of the Attorney General is unable to guarantee the accuracy of this translation and is therefore not liable for any inaccurate information resulting from the translation application tool.

Please consult with a translator for accuracy if you are relying on the translation or are using this site for official business.

If you have any questions please contact:Bilingual Services Program at (916) 324-5482

A copy of this disclaimer can also be found on our Disclaimer page.

Select a Language Below / Seleccione el Idioma Abajo

Close this box or use the [ X ]