Cost – Other eligible registrants (Canadian and International)
Accommodations include arrival of student the night before course start date.
Cost is based on the Single room with a shared bathroom priced at $ 95.00/night
Travel grant funding may be available (for non-federal police agencies only)
Forensic investigation often requires understanding whether a particular computer system has been used to commit an offence. This workshop provides students with the necessary skills to forensically analyse registry database files within the Microsoft Windows operating system. Students use hands-on exercises to interpret registry key values – whether they are deliberate actions of a computer user or form part of automated computer processes. This workshop is open to full-time computer forensic personnel with basic computer forensic training and work experience in the extraction and interpretation of digital evidence.
Format and delivery
Length of course
maximum 20 students
Understanding the purpose and value of registry files.
Ability to use different techniques to locate and verify registry data content.
Ability to extract and interpret registry file information on running computer systems.
Ability to conduct a preliminary on-scene live examination of registry files.
Understanding how to interpret registry data that explains the presence of externally connected devices.
Ability to extract and interpret information/evidence from older backup copies of registry files.