LINUX in Computer Forensics

Course Description

- This 40-hour course is designed to provide investigators of high technology and/or computer crime, and conducting computer forensic investigations, with training on use of the software LINUX as a forensic tool. Students will learn about special problems associated with doing computer forensics on a system using LINUX software as an Operating System. Students will learn how to use LINUX without making any changes to original media. The course consists of lecture, hands on classroom exercises and instructor lead as well as self-paced lab work.

Who Should Attend

-Peace officers assigned to a computer crime unit/task force who are assigned responsibility for computer forensic investigations.

Pre-requisites

-Students must have completed a basic computer forensics course, and it is recommended that they have completed the ATC’s Computer Digital Evidence Recovery class.

Course Objectives

-Upon completion of this class, students will have the knowledge necessary to examine a seized system that is using LINUX as operating system software. Additionally, students will know how to use parts of the LINUX operating system as forensic tools, to assist the investigator in completing computer forensic investigations.

Course Outline

• LINUX and Open Source software development
• LINUX file structure
• LINUX hardware protocols and naming conventions
• Command line switches and arguments
• Command line vs. G.U.I.
• Forensic uses for LINUX
• Lab work and case exercise

Additional Information

- For further information, contact the ATC at (916) 464-1200, and ask for the Program Training Manager or Secretary for this course.