Course Catalogue & Schedule

This course provides the fundamental knowledge and skills required to acquire forensic backup images of commonly encountered forms of digital evidence (Microsoft® Windows®-based computers and external storage devices) in a forensically-sound manner. Presentations and hands-on practical exercises cover topics on storage media and how data is stored, the forensic acquisition process, tool validation, hardware and…

This course provides students with the fundamental knowledge and skills necessary to perform a limited digital forensic examination, validate hardware and software tools, and effectively use digital forensic suites and specialized tools. The course begins with a detailed explanation of the digital forensic examination process, including documentation, case management, evidence handling, validation, and virtualization. Students…

This course introduces investigators and digital forensics professionals in law enforcement to the file systems utilized by Microsoft Windows®. The course provides knowledge and skills that will assist students in many facets of their examination of digital evidence located in FAT32, exFAT, and NTFS formatted media. The concepts covered for each of the file systems…

This course covers the identification and extraction of artifacts associated with the Microsoft® Windows® operating system. Topics include the Change Journal, BitLocker®, and a detailed examination of various artifacts found in each of the Registry hive files. Students also examine event logs, Volume Shadow Copies, link files, and jump lists. This course uses a mixture…

This course teaches students to identify various artifacts typically located in property lists and SQLite databases on macOS®-based computers. It also teaches students how to perform forensic analysis. Key concepts covered in this course include processing basics, SQLite databases, SQLite queries, and native system-related artifacts. Students will use hands-on practical experience writing basic SQLite queries…