MINISTRY OF DEFENCE FUNDING

	Enhanced Learning Credits Administration Service (ELCAS)
7Safe provides Level 7 (of 8) nationally recognised qualifications on the National Qualifications Framework.

The course

On this 3 day practical computer forensics training course, gain an understanding of static computer forensics analysis by learning about forensic principles, evidence continuity and methodology to employ when conducting a forensic investigation. Using practical case scenarios, you will be guided through the process of conducting a computer forensics investigation, and will learn the principles surrounding the collection of evidence, together with the forensic tools associated with forensic analysis. Delegates who successfully complete the exam included at the end of the training course will be awarded the Certified Forensic Investigation Practitioner (CFIP) qualification.

Course Content

Introduction to Computer Forensics
Introduction to Investigations
1. Areas involved in a forensic investigation
2. Investigation awareness phase of a forensic investigation
3. Principles of forensic computing
4. The 'Chain of Custody' process
5. Applying the chain of custody process
Identification and Seizure
1. Common electronic evidence devices
2. Seizure process of electronic evidence
3. Evidential items of interest
4. Actions performed on an electronic device
Understanding Electronic Data
1. Multiple bits
2. Large quantities of bytes in data storage
3. Decimal, Hexadecimal, ASCII, Unicode
Storage and File Systems
1. Preparing a hard drive for data storage
2. Physical disks and logical drives.
3. Differences between data and metadata
4. Common file system metadata
5. The purpose of file systems
6. Various file systems' features
7. Live Data, Deleted Data, Unallocated Data
Forensic Acquisition
1. Differences between a forensic image and a clone
2. Hashing within the forensic acquisition process
3. Common tools and hardware
4. Forensic acquisition and verification of an electronic device
Data Management
1. Data backups of electronic evidence
2. Logistical issues with data backups
3. Working copies of electronic evidence
4. Data retention periods of electronic evidence
Forensic Analysis Techniques
1. Five possible analysis environments
2. Recovering data from an electronic device using data carving
3. Keyword searching
4. Issues associated with data extraction
5. Strengths and weaknesses of hash analysis
6. Common file type specific metadata
7. Date and time analysis
Recovering Forensic Artefacts
1. Vista registry
2. Internet history
Data Reduction Techniques
1. Filtering data
2. Hash analysis
3. Data interpretation process
4. Dangers of data reduction
5. Filtering using date and time stamps
6. The use of data reduction techniques
Forensic Challenges
1. Data wiping
2. Data encryption
3. Malicious software
Reporting
1. Purpose of forensic reporting
2. Expected outcome of a forensic investigation
3. Target audience
4. Reporting methods
5. Defence statements