FRN 7871 Introduction to Computer Forensics
Instructors: Various Field Practitioners/ Steve Hickey, Insight Forensics, Charlotte
(Prerequisite: Hardware Fundamentals for Law Enforcement or equivalent training/knowledge) This course teaches students how to identify, acquire, analyze, and report on computer-based investigations involving Microsoft-based operating systems. It covers hard disk geometry in depth from the physical construction to the logical function, as relevant for a computer forensics specialist. The course also provides a thorough examination of MS-DOS-based file systems and their forensic purposes, including an introduction to NTFS. Students will obtain hands-on experience working with hard disk geometry, data allocation processes, and data recovery methods. In addition, students will use imaging tools to learn proper evidence acquisition methods and will learn how to create a forensically controlled boot environment, as well as to perform some forensic analysis procedures. This course focuses on building knowledge fundamentals required to properly acquire binary data so that an investigator can proceed with a computer forensic examination. Students will complete the beginning elements of a computer forensic examination from secure data acquisition to analysis. An introduction to reporting is included in the class, but covered more thoroughly in the Intermediate Course.