Internet Evidence Analysis
Course detail
2022
| Session(s) | Location | Start date | End date |
|---|---|---|---|
| 22-01 Full | Ottawa | 2022-11-28 | 2022-12-09 |
| Tuition | Accommodation | Full Meals | Total |
|---|---|---|---|
| $ 4,300.00 | $ 1,140.00 | $ 900.00 | $ 6,340.00 |
Notes
- Accommodations include arrival of student the night before course start date.
- Cost is based on the Single room with a shared bathroom priced at $ 95.00/night
- Travel grant funding may be available (for non-federal police agencies only)
Description
The course provides the knowledge and necessary skills to conduct a forensic examination on computer systems for Internet artifact evidence created by various software applications on a Microsoft Windows operating system. Artifact evidence created by these various applications ranges from settings, to log files, and to files created as a result of application use. The most widely used applications are explored, including web browsers, email, instant messaging, peer to peer, social networking, webmail and cloud platforms.
Format and delivery
- Length of course
- 10 days
- Class size
- maximum 20 students
- Delivery setting
- theoretical and practical components are done in a computer laboratory
Learning outcomes
- Knowledge of basic Internet communication protocols and content.
- Ability to process forensic artifact evidence created by web browsers.
- Ability to locate forensic artifact evidence created by popular instant messaging clients.
- Understanding how to assemble forensic artifact evidence created by peer-to-peer clients running on a Microsoft Windows operating system.
- Understanding how to identify artifact evidence created by social networking websites on the Internet.
- Knowledge of the legal issues pertaining to online investigations.
Eligibility and mandatory requirements
- This course is offered to law enforcement officers and civilian computer forensic analysts who:
- have been part of a technological crime unit for at least two years
- have basic skills in the use of a current leading forensic software tool
- Registrants must have completed the Computer Forensic Examiner Course (CMPFOR). In absence of CMPFOR, considerations is given to experienced computer forensic examiners, preferably with two years' experience.
- Acceptance or refusal in the course is at the discretion of the Canadian Police College.
Assessment
- Success in the course is based on participation and completion of all required assignments.
- Various evaluation methods are used, including a written exam, practical exercises and mapping exercises.
- Re-testing or re-evaluation is conducted at the discretion of the course instructor.
Contact
For more details or other information about the course, please email cpcregistrar@rcmp-grc.gc.ca.
- Date modified: