This 40-hour course is designed to provide investigators with the training, skills, knowledge and practical experience in using some of the more advanced tools developed for computer forensics. Instruction will be provided on different tools each fiscal year.
The course includes:
The principles of how/why the tool was developed;
Imaging digital evidence;
How the tool verifies and ensures no changes to original evidence;
Setting up a forensic case;
Use of Hash and Signature analysis to limit area searched;
Boolean terms, GREP expressions and Scripts to increase search effectiveness,
Creating a report of results of investigation
Lectures and hands-on activity.
Students will understand the functions and capabilities of the forensic tool. They will receive training and practice using the tool to conduct forensic investigations. The training will include how to make image files of digital evidence and how to verify that no changes were made to the evidence while conducting the investigation.
Successful completion of D300 Computer Digital Evidence Recovery. Students should be law enforcement personnel assigned to high technology crime investigation units, white collar crime units, fraud or forgery units, sex and vice crimes units with the assigned responsibility for computer forensic investigations.
There is no cost to local law enforcement agencies. State and federal employees who qualify for this class may pay $1,729 for registration and materials.