CJC-FRN7872 - Intermediate Computer Forensics

Course Description

The Intermediate Computer Forensics course builds on the concepts covered in Introduction to Computer Forensics.  Students should already be familiar with identification and acquisition of digital evidence on Microsoft-based operating systems.  Students will obtain hands-on experience working with a variety of analysis tools and perform forensic examination of computer evidence. This course focuses on building the proficiency of the forensic examiner by using advanced analysis tools and techniques.

Course Outline

1. Review of Introduction to Computer Forensics 
   • Forensic - Boot Environment
   • Preparing Acquisition Environment
2. Reporting at Seizure Stage 
   • Media Analysis and Description
   • Hard Disk Parameters
   • CPU Settings
3. Restore of Image File 
   • Image Authentication
   • Hashing
4. Logical Disk Parameters 
   • FAT32 vs. NTFS
   • Virtual Memory Capturing
5. Analysis Tools 
   • FAT32
   • NTFS
   • Automated
6. Creating an Examination Report 
   • Media Analysis and Description
   • Report of Findings
   • Description of Procedure
7. Quality Assurance 
   • Methodology Communication Efficiency
   • Findings Communication Efficiency
8. Forensic software
   • Familiarization with Access Data tools
   • Familiarization with Encase tools

Learner Outcomes

Upon successful completion of this course, the student will be able to complete the following:

• Disk Parameter Recognition and Creation
• Recognize FAT32 vs. NTFS Forensic Examination Abilities and Inabilities
• Use of Analysis Tools
• Creation of Report 
  • Media Analysis and Description
  • Written Communication of Findings
  • Description of Procedure

Notes

Method of Instruction: Lecture, PowerPoint, Discussion and Practical

Evaluation:

• Exam:  Successfully complete practical activities, forensic examination report, and written exam.
• Demonstration of Skills:  Students must be able to show that they can utilize analysis tools and create a forensic examination report with effective written communication.
• Class Participation:  Every student must participate in practical activities in order to demonstrate understanding of concepts covered in class.