Registry Analysis Workshop
Course detail
2023
| Session(s) | Location | Start date | End date |
|---|---|---|---|
| - | - | - | - |
| Tuition |
|---|
Notes
- Accommodations are offered to course participants. Our rooms are subject to availability and the request must be indicated on the course registration form
- Meal plans are offered to course participants. The specific meal plan must be indicated on the course registration form
- Travel grant funding is available to our non-federal law enforcement agencies
Description
Forensic investigation often requires understanding whether a particular computer system has been used to commit an offence. This workshop provides students with the necessary skills to forensically analyse registry database files within the Microsoft Windows operating system. Students use hands-on exercises to interpret registry key values – whether they are deliberate actions of a computer user or form part of automated computer processes. This workshop is open to full-time computer forensic personnel with basic computer forensic training and work experience in the extraction and interpretation of digital evidence.
Format and delivery
- Length of course
- 4 days
- Class size
- maximum 20 students
- Delivery setting
- computer classroom
Learning outcomes
- Understanding the purpose and value of registry files.
- Ability to use different techniques to locate and verify registry data content.
- Ability to extract and interpret registry file information on running computer systems.
- Ability to conduct a preliminary on-scene live examination of registry files.
- Understanding how to interpret registry data that explains the presence of externally connected devices.
- Ability to extract and interpret information/evidence from older backup copies of registry files.
- Knowledge of software programs frequently used.
Eligibility and mandatory requirements
- Registrants must have completed the Computer Forensic Examiner (CMPFOR) course.
- Acceptance or refusal in the course is at the discretion of the Canadian Police College.
Assessment
- Success in the course is based on participation and completion of all required assignments.
Contact
For more details or other information about the course, please email cpcregistrar@rcmp-grc.gc.ca.
- Date modified: