Computer Forensics Level I Training

Online - 50 Hours

This is not a "watered down" training course.  Not like other courses, we tell you in detail what we cover during the course and what our experience and expertise is.  We have a great training course, great material, experienced instructors and we truly want you to learn the material and to become good forensic examiners.  We want you to compare and decide what is best for you.    

Our instructors are all Certified Forensic Computer Examiners or Certified Computer Examiners (CCE)® who are currently involved in computer forensic examinations.  They will coach and tutor you through the practical exercises, your reports and through the test questions for each module.  Our instructors are highly qualified, experienced and understand forensic examinations far beyond the material in this course.  Your interaction with your instructor will normally be via email, but direct assistance is available.   We truly want you to learn the material and to become a good forensic examiner. 

This online program is designed for people interested in becoming Computer Forensics experts. Students move at their own pace through all 3 levels (5 modules) and learn how to forensically Exam(s)ine and recover data from DOS, Windows 95 and Windows 98 operating systems. Students learn core forensic procedures for any operating or file system, and how to conduct forensically sound Examinations to preserve evidence for admission and use in legal proceedings. Each module requires an Exam(s) and completion of practical exercises before you can move to the next module. Additionally, this course will help prepare you for the upcoming Certified Computer Examiner (CCE) Examination.

LEVEL I

Module 1

• An overview of what types of crimes computer evidence might be used in. 
• How to deal with clients and employers.
• How to initially determine the scope of the examination.
• How to determine what must be done and how you should proceed in an examination.
• An overview of why trained forensic examiners should be used and what they may expect to encounter. 
• Software ethics. 
• Forensic ethical standards. 
• Forensic examination procedures. 
• Preparing and verifying forensically sterile examination media.
• Note taking and report writing.
• Personal computer construction, hardware and software with focus on the BIOS, BIOS limitations, hard disk translation schemes and how they can effect forensic examinations.
• A very broad overview of several operating systems including:
  •   Windows NT/2000
  •   Novell 
  •   Unix/Linux 
  •   DOS 
  •   Windows 95/98
• A broad overview of networks.
• Instruction on the acquisition, collection and seizure of magnetic media. 
• How to best acquire, collect or seize the various operating systems.
• Legal and privacy issues.
• Establishing a sound "chain of custody".
• Note  - we believe a sound understanding of the FAT file system is essential.  Flash media, such as "Thumb " Drives, flash cards in digital cameras, most cell phones, etc. are all stored on disk using the FAT file system.
• The beginning logical structures of the Microsoft operating system FAT file system. -
• How to recover simple deleted files.
• There are four practical exercises in preparing and verifying forensically sterile media, using a "carving" utility to recover data from unallocated space and the manual recovery of simple deleted files.
• A written examination regarding the material covered in this module.

We will provide a detailed handout for each module covered.  The handouts can be used as a reference manual.  Sample reports, additional practical exercises, a DOS primer, Diskedit primer and other useful information and applications will be provided. You will be subscribed to our listservers that provide both administrative and technical information.  Even after you complete the course, as material is updated, you will be able to download the new material from our web site.

We will provide some forensic software that was written specifically for forensic examiners, including:

•   A fast and thorough wiping program
•   A fast checksum program 
•   A fast program that documents files (including deleted files) on a drive 
•   A program that will allow examination of unallocated space
•   A program that will make exact forensic copies of floppy diskettes
•   An excellent forensic "carving" utility
•   The Passware Kit from Lost Password.com  
•   See hardware and software requirements for details on the software provided.

You will be required to purchase:

•   Norton Utilities
•   Norton Ghost
•   QuickView Plus (a viewing application) QuickView
•   A good virus scanning utility
•  You will be required to use your own USB  drive for the examinations.  We recommend a size no less than 32 MB

Demo1 - This is a simple practical exercise that simulates a common issue that a forensic examiner may encounter. This demonstration practical exercise is based upon actual cases.

To download and open Demo1:

o    Click on the Demo1 link above. 

o    Download the demo1.zip file. 

o    Unzip the demo1.zip file to get demo1.exe.

o    Have a freshly formatted 3 1/2 inch HD diskette ready and execute demo1.exe.

o    You will be prompted to place the freshly formatted diskette in your A: drive.

o    The "original" demo1 diskette will be created and will be ready for examination.