DF101 – Basic Digital Forensic Analysis: Seizure (BDFA-WIN-ACQ)
This course provides the fundamental knowledge and skills required to acquire forensic backup images of commonly encountered forms of digital evidence (Microsoft® Windows®-based computers and external storage devices) in a forensically-sound manner. Presentations and hands-on practical exercises cover topics on storage media and how data is stored, the forensic acquisition process, tool validation, hardware and software write blockers, forensic backup image formats, and multiple forensic acquisition methods. Students will use third party tools, both free and commercial, that are currently used by practitioners in the field.
Students who complete this course and pass the post-test are eligible for 1.0 point toward the 3CE certification.
Key concepts covered in this course include:
Forensic acquisition process and methods
Hardware and software write blockers
Forensic backup image formats
Who Should Attend
This course is intended for law enforcement personnel with a solid understanding of computers and common software applications.