This 80-hour course provides investigators of high technology and/or computer crimes with training on tools and procedures for conducting difficult and detailed forensic examinations of personal computers and seized digital media. Students will also learn how to build their own forensic analysis computer, troubleshoot and repair problems with their computers, and become familiar with advanced capabilities of tools available to the forensic analyst.
The course includes:
Laws relative to search warrants and recovery of digital evidence;
How to build and trouble-shoot an efficient forensic analysis computer;
Available analysis tools for recovery of digital evidence;
Preservation, recovery and examination of digital evidence;
Limiting forensic analysis to case needs;
Reporting evidence discovered in digital format;
Discovery issues (contraband, instruments, etc.),
Lab work and case exercises
Lecture, hands-on classroom exercises, and 32 to 44 hours of laboratory work.
Students will have the knowledge necessary to build a forensic computer, troubleshoot and repair problems with their forensic computer, be aware of advanced capabilities of software tools available for forensic analysis, have used some of the more popular tools, and be able to properly and effectively develop, analyze and present for prosecution, a digital evidence case.
Completion of D300 Computer Digital Evidence Recovery and D310 PC Forensics - Specialized Tools.
Successful completion of a pre-test, to judge student skills and knowledge on computer crime investigation and computer operations, will be required prior to admission to this course. The test will also give the prospective students insight to the level of training presented in this course.