PC FORENSICS/Data Collection

Course Description

- This 32-hour course is designed to provide investigators of high technology and/or computer crimes with basic training on tools and procedures for conducting forensic examinations of personal computers and seized digital media. Students will learn how to seize and image digital media in the correct and accepted manner, they will learn how computers store data in tables, files and logs and become familiar with advanced capabilities of tools available to the forensic analyst. The course consists of lecture, hands on classroom exercises and 16 to 20 hours of lab work.

Who Should Attend

- Peace officers assigned to a computer crime unit or task force who are, or will be required to conduct computer forensic examinations of seized digital evidence.

Pre-requisites

- Student must have completed the ATC’s High Technology and Computer Crime Investigations class and successfully pass DOS Command pre-test.

NOTE:

Successful completion of a pre-test, to judge the student’s skills and knowledge on computer crime investigation and computer operations, will be required prior to admission to this course. The test will also give the prospective students insight to the level of training presented in this course.

Course Objectives

-Upon completion of this class, students will have the knowledge necessary to seize and image digital evidence correctly, be aware of advanced capabilities of software tools available for forensic analysis, have used some of the more popular tools, and be able to properly and effectively develop, analyze and present for prosecution, a digital evidence case.

Course Outline

• How computers store data
• Files, logs, and tables created by modern operating systems
• How to correctly seize digital evidence
• Imaging digital evidence
• Available analysis tools for recovery of digital evidence
• Preservation of recovered digital evidence
• Examination of recovered digital evidence
• Limiting Forensic Analysis to case needs
• Discovery Issues (contraband, instruments, etc.)
• Lab Work and Case Exercises

Additional Information

- – For further information, contact the ATC at (916) 464-1200, and ask for the Program Training Manager or Secretary for this course.