Instructor-Led Course 5 or 6 days |
| Dedicated Classes at your facility CALL |
| Outline Updated March 20 2003 |
| Now available to government and private sector clients is a highly cost effective approach to upgrading the technical skills of their investigative, intelligence and support personnel. Our lead instructor and Computer Forensics course developer was a pioneer in federal law enforcement computer forensics and Internet crime investigations with over a quarter century of federal law enforcement experience, culminating in the development and management of a national agency computer forensics program. The instructor brings an insightful approach second to none. A Computer Forensics Certification.
The Computer Forensics Examiner (CFE) Basic 5-day laboratory intensive course is designed to equip government and corporate investigators/analysts with the skills needed to safely locate and secure computer evidence at the search site as well as subsequent off-site analysis. Forensic concepts and procedural skills are reinforced during a written examination and challenging comprehensive group exercise.
An optional 9-hour seminar focusing on hacker and p-o-r-nography Internet investigations is also available. (See below)
Prerequisites:
This course is unusually fast paced, covering as much technical instruction as government courses lasting twice as long. Students are assumed to be familiar with the MS Windows operating environment and to have experience using command line utilities (i.e., Format, Copy, CD, RD, MD, Attrib and Edit). "DOS for Dummies" and Peter Norton's "Inside the PC" provide an excellent background if needed. Prior programming or law enforcement experience is highly beneficial, albeit not required. Student backgrounds span accomplished Windows users to graduates of computer science degree programs. Depending upon background, students should expect to engage in varying degrees of independent study prior to each class day.
Follow on course: Advanced Computer Forensics Examiner
Start times vary by location (8-9am) |
| Day One |
| |
|
|
8:00 a.m.
8.30 a.m.
9:00 a.m.
10.00 am.
11:00 a.m.
12:00 a.m.
1:00 p.m.
2:00 p.m.
3:00 p.m.
4:00 p.m. |
-
-
-
-
-
-
-
-
-
- |
Course Overview and Class Introduction
Computer Crime - Now & the Future
Key Disk Preparation
Diskette & Zip Operations
Fixed Disk Operations
Lunch Break
Command Line Operations
Microcomputer Fundamentals
Network Fundamentals
Initial Response Team Deployment Kit |
|
| Day Two |
| |
|
|
8:00 a.m.
9:00 a.m.
11:00 a.m.
12:00 a.m.
1:00 p.m.
4:00 p.m.
4:30 p.m. |
-
-
-
-
-
-
- |
Preparing for a Computer Search
On-site Computer Search Guidelines
Automated Forensics Analysis Tools
Lunch Break
Automated Forensics Analysis Laboratory
Fixed Disk Imaging Laboratory - FAT
Fixed Disk Imaging Laboratory - NTFS |
|
| Day Three |
| |
|
|
8:00 a.m.
9:00 a.m.
10:00 a.m.
11:00 a.m.
12:00 a.m.
1:00 p.m.
2:00 p.m.
3.00 p.m.
4.00 p.m. |
-
-
-
-
-
-
-
-
- |
Microcomputer Storage
DOS to Windows XP Overview
Manual Forensics Analysis Tools
Maresware Utilities Laboratory
Lunch Break
Norton Utilities Laboratory - GUI Utilities
Norton Utilities Laboratory - WipeInfo
Norton Utilities Laboratory - Disk Editor
Hidden Data Laboratory |
|
| Day Four |
| |
|
|
8:00 a.m.
9:00 a.m.
11:00 a.m.
12:00 a.m.
1:00 p.m.
2:00 p.m.
3.00 p.m.
4.00 p.m. |
-
-
-
-
-
-
- |
Password/Encryption Laboratory
Computer Evidence Handling
- Quick View Plus Laboratory
Lunch Break
Technical Report of Investigation
Screen Capture & Graphics Editing
Erased File Restoration Laboratory
In-depth Analysis Considerations |
|
| Day Five |
| |
|
|
8:00 a.m.
9:00 a.m.
10:00 a.m.
11:00 a.m.
12:00 p.m.
1:00 p.m.
4:30 p.m. |
-
-
-
-
-
-
- |
Written Exam Independent Study
Basic Comprehensive Written Exam
Student CD Contents Review
Comprehensive Group Exercise
Lunch Break
Comprehensive Group Exercise
Basic Course Completion Certificate |
|
| Optional Day Six - Internet Investigations |
| |
|
|
8:00 a.m.
9:00 a.m.
10:00 a.m.
11:00 a.m.
12:00 p.m.
1:00 p.m.
2:00 p.m. |
-
-
-
-
-
-
- |
Introduction to the Internet
Internet Sources of Information
Hacker Profile Analysis
E-mail Header Analysis
Lunch Break
Usenet/Chatroom Operations
Internet Activity Laboratory |
|
