This course covers the fundamentals of computer operations, hardware function, configuration, and best practices for the protection, preservation, and imaging of digital evidence. Presentations and hands-on exercises cover topics such as partitioning, data storage, hardware and software write blockers, the boot-up and shutdown processes, live imaging, encryption detection, and duplicate imaging. This course incorporates computer forensic applications that experienced practitioners are currently using in the field.
- Fundamental building blocks for computer forensics;
- Best practices for forensic imaging, imaging at the scene, and validating forensic tools;
- Encryption detection with live imaging; and
- Hands-on exercises.