PC Forensics / Specialized Investigative Tools

Course Description - This 40 hour course is designed to provide investigators with the necessary training, skills, knowledge and practical experience in using some of the more advanced tools developed for computer forensics. Instruction will be provided on different tools each Fiscal Year.

Pre-requisites - Students applying for this course must have completed the ATC's Computer Digital Evidence Recovery (CDER) class.

Who Should Attend - Law enforcement personnel assigned to high technology crime investigation units, white collar crime units, fraud or forgery units, sex and vice crimes units with the assigned responsibility for doing computer forensics. This class is one of the prerequisites for attending ATC's PC Forensics/Advanced Investigations class.

Course Objectives - Upon completion of this course, students will understand the functions and capabilities of the forensic tool. They will receive training and practice using the tool to conduct forensic investigations. The training will include how to make image files of digital evidence and how to verify that no changes were made to the evidence while conducting the investigation.

Course Outline

• The principles of how/why the tool was developed
• Imaging digital evidence
• How the tool verifies and ensures no changes to original evidence
• Setting up a forensic case
• Use of Hash and Signature analysis to limit area searched
• Word/text searching
• Boulean terms, GREP expressions and Scripts to increase search effectiveness
• Creating a report of results of investigation

Additional Information - For further information contact the ATC at (916) 464-1200, and ask for the Program Training Officer or Secretary for this course.