• Online, Instructor-Led
  • Classroom
Course Description

If you or your organization requires the knowledge or skills to identify, track, and prosecute the cybercriminals, then this is the course for you. This course helps students to excel in digital evidence acquisition, handling and analysis in a forensically sound manner. Acceptable in a court of law, these skills will lead to successful prosecutions in various types of security incidents such as data breaches, corporate espionage, insider threats and other intricate cases involving computer systems.

Learning Objectives

The computer forensic investigation process and the various legal issues involved; Evidence searching, seizing and acquisition methodologies in a legal and forensically sound manner; Different types of digital evidence, rules of evidence, digital evidence examination process, and electronic crime and digital evidence consideration by crime category; Roles of first responder, first responder toolkit, securing and evaluating electronic crime scene, conducting preliminary interviews, documenting electronic crime scene, collecting and preserving electronic evidence, packaging and transporting electronic evidence, and reporting the crime scene; How to set up a computer forensics lab and the tools involved in the lab; Various file systems and how to boot a disk; Gathering volatile and nonvolatile information from Windows; Data acquisition and duplication rules, validation methods and tools required; How to recover deleted files and deleted partitions in Windows, Mac OS X, and Linux; The process involved in forensic investigation using AccessData FTK and EnCase; Steganography and its techniques, Steganalysis, and image file forensics; Password Cracking Concepts, tools, types of password attacks and how to investigate password protected files; Different types of log capturing, log management, time synchronization, and log capturing tools; How to investigate logs, network traffic, wireless attacks, and web attacks; How to track e-mails and investigate e-mail crimes; Mobile forensics and mobile forensics software and hardware tools; How to write investigative reports

Framework Connections

The materials within this course focus on the Knowledge Skills and Abilities (KSAs) identified within the Specialty Areas listed below. Click to view Specialty Area details within the interactive National Cybersecurity Workforce Framework.

Feedback

If you would like to provide feedback for this course, please e-mail the NICCS SO at NICCS@hq.dhs.gov.