CJC-FRN7871 - Introduction to Computer Forensics

Course Description

The Introduction to Computer Forensics course deals primarily with how to identify, acquire, analyze, and report on computer based investigations involving
Microsoft-based operating systems. Students will obtain hands-on experience working with imaging tools, analysis tools, creating a forensically safe boot disk, in addition to other processes required for examination of digital evidence. This course focuses on building knowledge fundamentals to perform a forensic examination by having students complete all phases of a basic examination from acquiring to reporting.

Course Outline

1. What is Computer Forensics

Acquisition
Authentication
Analysis

2. Hard Disk Geometry - Physical Construction

Types of Hard Disk Drives
Hard Disk Construction
Physical Data Allocation

3. Hard Disk Geometry - Logical Construction

Directories, Volumes
Introduction to Hexadecimal system
Logical Data Allocation

4. Data Structuring

File Allocation Tables
Introduction to Hex Viewer
Participating

5. Forensic Acquisition

Boot Process
Creating a forensically-controlled boot environment
Forensic Imaging
Types of Space on Hard Drive

6. Forensic Analysis System

Hardware Requirements
Software Requirements

7. Introduction to Hashing

8. Quality Assurance

Forensic Methodology
Evidence Handling

Learner Outcomes

Explain concept of computer forensics
Identify physical and logical hard disk geometry
Prepare hard disks for use in computer forensics
Perform forensic acquisition of hard disk media
Create a forensically-sound acquisition environment

Notes

Method of Instruction:
Lecture and Hands-on Practical exercises

Evaluation:

1. Exam: Successfully complete practical activities and Written Exam.
2. Demonstration of Skills: Students must be able to show that they can perform a
forensic acquisition of a hard drive and begin the basics of a computer forensic
examination.
3. Class Participation: Every student must participate in practical activities in order
to demonstrate understanding of concepts covered in class.

Prerequisites

This course is being offered to sworn Law Enforcement Officers or individuals associated with a law enforcement agency only.