Search for:

CPD Training Course
Understanding Computer Evidence (6 hours CPD)

Thursday 23 September 2010

• Give delegates an improved understanding of the reports generated by computer forensic investigations
• Provide an overview of legislation & best practice guidelines used during computer forensic investigations
• Provide an overview of the types of evidence that can be obtained from computers
• Provide an overview as to how such evidence might be preserved and how to assist the forensic investigator with their enquiries
• Explain how dates and times shown on the computer may or may not be relevant
• Explain what metadata could be hidden within files
• Explain how a hard drive works and how files can be recovered, even after having been supposedly deleted
• Give delegates an understanding of how to assist the forensic examiner with regards to keyword searching and passwords
• Provide an understanding of the analysis methods used
• Provide an overview of how emails and the internet work and how to trace the sender of the email
• Provide information on what the email header means and how to interpret it
• Provide an overview of how scanned paper documents can be treated as electronic documents
  

9.30am
10.15am
11.00am
11.30am
12.15pm
1.00pm
2.00pm
2.45pm
3.30pm
4.00pm
4.45pm
5.30pm

Introduction
Sources of Evidence
Coffee Break
Date/Time Stamps & Metadata
Disk Structure & Deleted Files
Lunch
Forensic Analysis
Emails & Internet
Coffee Break
Case Study
Summary and Q&A Session
Close