Have you been charged with finding abuse or even criminal activities in your companies IT systems? Computer abuse and crime is here to stay. Digital Forensics deals with the recovery and investigation of information from digital devices like computers, cell phones, and more. The rate of fraud in recent years requires increasing IT duties as a very important part of the overall security picture. This class introduces the basic concepts and procedures as well as the “how-to” skills of forensics using hands on exercises.

In this course we will investigate Windows OS computers though the lessons learned can easily be applied to Unix, Linux or Mac OS X. Recommended as the 3rd course in the Information Security Certificate.

Performance Objectives: Upon completion of this course you should be able to:

• Describe what is digital forensics
• Explain the effect of Locard’s Exchange Principle
• Implement a digital forensic investigation
• Explain the difference in a live vs dead system investigation
• Build a “go kit” for portable and on-site investigations
• Understand the impact of chain-of-custody
• Investigate a Windows OS system
• Implement or defend against anti-forensics
• Describe the legal issues in forensic investigations
• Find browsing history, cookies, and more
• Find photos and documents saved or used
• Implement a timeline to see when items where added or changed

Competencies covered in this course: Defining digital forensics, Investigations of operating systems

Intended Audience: Any computer technology professionals needing IT security skillset.

Recommended Pre-requisite: To be successful in this course, you should be familiar with using personal computers, the mouse and keyboard. You should be able to use Windows to launch and close programs; navigate to information stored on the computer; and manage files and folders. Windows Experience is helpful in this course. Recommended as the 3rd course in the Information Security Certificate.