Computer Digital Evidence Recovery

Course Description

- This 80-hour course is designed for investigators who have basic computer skills and are new to the field of computer forensics. This class will provide training on: forensic computer components; set-up and trouble shooting; case management; writing a search warrant for a computer forensic case; search and seizure of computer/digital evidence; tools, skills and protocols necessary to assist in the forensic investigation and prosecution of computer crime.

Who Should Attend

- Investigators who are currently assigned, or will soon be assigned, to perform forensic investigations on digital evidence. It is recommended that students complete POST's ICI Domain Specialty Course on Computer Investigations and a basic seizure and examination of digital evidence course before attending this course.

NOTE:

Successful completion of a pre-test, to judge the students skills and knowledge on computer crime investigation and computer operations, will be required prior to admission to this course. It will also give the prospective students insight to the level of training presented in this course.

Course Objectives

- This is a hands-on course that involves practical exercises which are designed to simulate criminal situations and test the students ability to complete a successful forensic investigation on digital evidence.

Course Outline

• Introduction to Computer Forensics
• Fundamentals of Computer Hardware
• Working a Case from the Beginning to the Final Report
• Conducting Basic Searches and Analysis of Evidence
• Overview of Forensic Software
• Understanding File Systems
• Evidence Identification
• Recovery, Removal, and Accessing Digital Media
• Legal Update, Writing Effective Search Warrants
• Preparing Evidence for Presentation in Court

Additional Information

- For further information contact the ATC at (916) 464-1200, and ask for the Program Training Officer or Secretary for this course.