Title
DFE - Digital Forensic Essentials
Days
2
Price
$1,195.00

DFE - Digital Forensic Essentials

Description

This entry-level two (2) day course provides a solid foundation of knowledge and skills for beginning forensics and eDiscovery practitioners.

Objectives

This course is designed to provide foundational skills for a digital forensic examiner, eDiscovery specialist, or first responder.  Lessons presented will focus on:

  • Identifying various digital forensic media
  • Best practice collection of digital media / evidence
  • Best practice transportation of digital media / evidence
  • Forensic triage methods
  • Duplicating digital media / evidence

Prerequisites

This course is designed for a beginning practitioner with a basic understanding of the Microsoft Windows operating system environment and function.  Students should meet or exceed the following:

  • Read and understand the English language
  • Have familiarity with the Microsoft Windows environment
  • Have a basic understanding of data recovery concepts

Syllabus

Course Outline

The course will follow adult learning principles through training aids, presentations, diagrams, and instructor led practical exercises.  Each topic covered will be presented in either one or two 50 minute sessions followed by review questions.  Students will be given the opportunity throughout the course to ask questions and discuss objectives covered in more detail.  Ample time will be allotted for hands on exercises to reinforce the topics covered.

The course is structured as follows:

Introductions and Digital Forensics / eDiscovery Overview

  • Introductions by the students and course instructor
  • Identify the typical components of a digital forensic investigation
  • Identify the typical components of an eDiscovery examination

Hardware Recognition

  • Identify common digital hardware components
  • Discuss digital forensic items of interest in a typical forensic examination

Seizure and Transportation

  • Identify proper methods for dealing with live (running) computer systems at crime scenes
  • Discuss RAM capture from a live machine
  • Discuss proper packaging techniques for transporting digital media

Drive Interfaces

  • Identify drive interfaces / technology likely to be found
  • Explain the purpose and use of drive jumpers
  • Explain the purchase and use of drive adapters

BIOS and CMOS

  • Explain the purpose / use / forensic relevance of system BIOS
  • Explain the purpose / use / forensic relevance of system CMOS
  • Discuss methods to circumvent / disable passwords associated with the CMOS

Physical and Logical Characteristics

  • Explain physical components of digital media
  • Define the term sector and LBA
  • Explain logical structures of digital media

Computer Data

  • Explain how data storage on various digital media
  • Discuss the components of the ASCII / ANSI chart and define Unicode
  • Explain the binary, decimal, and hexadecimal numbering schemes
  • Identify various locations of interest where data will be found in various formats

Operating and File System

  • Provide a detailed overview of Operating System function and purpose
  • Identify the most common Operating Systems
  • Provide a detailed overview of a File System
  • Identify the most common File Systems

FAT File System

  • Describe the components of the FAT file system
  • Explain the "format" command and results of its use
  • Identify the system

 

Schedule

No classes scheduled at this time.

Questions? Would you like to learn more?