Computer Forensic Examiner (CMPFOR)

Formerly known as Electronic Search and Seizure

Purpose

This course is for those who may be required to seize and analyse potential digital evidence found on computer hardware. During this course, the specialized forensic foundations and practical skills required to recognize, recover, examine and document findings when dealing with personal computer systems will be covered.

To help ensure that the forensic examiner has the underlying knowledge to deliver relevant information with respect to any assigned case(s), participants will be provided with sound computer forensic methodologies.

Contemporary hardware platforms, devices and peripherals will be detailed to familiarize participants on the common vocabulary used in today's computer industry. Computer hardware will be examined to gain an understanding of the hardware, processes and common settings required to initialize and boot the modern computer system. Focus will be placed on disk drives and other common storage media to enable the learner to cope with various typical machine characteristics, settings and storage configurations as found on stand-alone computer systems that they will encounter in the field.

Underlying disk structures and common file systems will also be explored to provide insight and provide the grounding on how data is stored on various media. Current forensic tools will be used and methodologies will be developed to safely explore the data contained on a variety of computer storage media.

Successful students will be able to:

• Identify the major components of a personal computer;
• Identify common data storage media;
• Seize a personal computer and related computer media;
• Forensically image computer media;
• Authenticate forensically imaged computer media;
• Search and extract digital evidence; and
• Prepare reports on digital evidence findings

Course content

• computer hardware
• hard disk topology
• law and evidence
• forensic seizure of computer data
• modern computer file systems
• windows forensic software

Selection criteria

To be eligible to take this course, a candidate must meet the following criteria:

• is part of a law enforcement technological crime investigative unit or program;
• has authorization from their department to conduct computer forensic analysis; and
• has successfully completed the CompTIA A+ IT Technician Certification.
  (Exams 220-601 and 220-602).
  

Participant Assessment

Learning will be developmental, lecture, hands-on and scenario-based when apt, which will be guided by course facilitators and resources brought in from the field.

Frequent assessments in the form of assignments, quizzes or tests will serve as a guide for the candidates and facilitators to help focus the learner on areas requiring additional assistance or attention. A final exam at the conclusion of the course will examine all the material covered throughout the course and involve a hands-on scenario.

Duration of course: fifteen working days

Class size: A maximum of twenty participants.

Language of instruction: English