Course Outline

Computer forensics enables the systematic and careful identification of evidence in computer related crime and abuse cases. This may range from tracing the tracks of a hacker through a client’s systems, to tracing the originator of defamatory emails, to recovering signs of fraud.

Module 1:                  Introduction

Module 2:                  Computer Forensic Incidents

Module 3:                  Investigation Process

Module 4:                  Disk Storage Concepts

Module 5:                  Digital Acquisition & Analysis

Module 6:                  Forensic Examination Protocols

Module 7:                  Digital Evidence Protocols

Module 8:                  CFI Theory

Module 9:                  Digital Evidence Presentation

Module 10:                Computer Forensic Laboratory Protocols

Module 11:                Computer Forensic Processing Techniques

Module 12:                Digital Forensics Reporting

Module 13:                Specialized Artifact Recovery

Module 14:                e-Discovery and ESI

Module 15:                Mobile Device Forensics

Module 16:                USB Forensics

Module 17:                Incident Handling

Mile2 - Lab 1:  Preparing Forensic Workstation

  • AccessData FTK Imager Installation
  • Autopsy Installation
  • National Software Reference Library (NSRL) for autopsy
  • 7z Installation
  • Install Registry Viewer
  • Install Password Recovery Tool Kit (PRTK – 5.21)

Lab 2:  Chain of Custody

  • Chain of Custody Search and Seizure
  • Chain of Custody Forensic Imaging

Lab 3:  Imaging Case Evidence / FTK Imager

Lab 4:  Create a new case for Autopsy

  • Creating a Case in Autopsy

Lab 5:  Reviewing Evidence / Autopsy (Case #1)

  • User MTBG attempting to hack his/her previous employer
  • Reviewing Evidence in Autopsy

Case Study scenario:

  • The evidence you are required to discover (Challenge)

Final Report for MTBG case          

Lab 6:  Reviewing Evidence / Autopsy (Case #2)

  • Greg Schardt case

Case Study Scenario:

  • The evidence you are required to discover (Challenge)
 35 Hours

Related Categories