This course covers the fundamentals of computer operations, hardware function, and configuration, as well as best practices for the protection, preservation, and imaging of digital evidence. Presentations and hands-on exercises cover topics such as partitioning, data storage, hardware and software write blockers, the boot-up and shutdown processes, live imaging, encryption detection, and duplicate imaging. This course incorporates computer forensic applications that experienced practitioners are currently using in the field.
- Fundamental building blocks for computer forensics.
- Best practices for forensic imaging, imaging at the scene, and validating forensic tools.
- Encryption detection with live imaging.
- Supporting hands-on exercises.