Training

DF202 Intermediate Digital Forensic Analysis: Windows File Systems

This course provides students with the fundamental knowledge and skills necessary to perform a limited digital forensic examination, validate hardware and software tools, and effectively use digital forensic suites and specialized tools. The course begins with a detailed study of the digital forensic examination process, including documentation, case management, evidence handling, validation, and virtualization. Students learn to use today's leading commercial and open source digital forensic suites: Magnet Axiom, X-ways Forensic, and Autopsy. Instruction on each suite will include an interface overview, configuration, hashing, file signature analysis, keyword searching, data carving, bookmarking, and report creation.

*Digital forensic process. Evidence review; requests for examination; case management.
*Validation. Creation of validation images; validation testing.
*Effective tool usage. Tool interface; hashing; file signature analysis; data carving; searching; metadata; bookmarking.
*Reporting. General report structure; report templates; using tool-generated reports.

FC122 Intellectual Property Theft Training

This course introduces the problem of intellectual property theft and provides tools, techniques, and resources for investigating and prosecuting these crimes. A combination of lecture, discussion, and interactive exercises illustrates the potential dangers and economic repercussions of counterfeit products, as well as best practices and techniques for investigating IP theft. Students are provided with a state-specific folder that includes relevant statutes, sample organizational documents for IP investigations, and additional resources for investigators and prosecutors.

This course is presented in collaboration with the National Association of Attorneys General (NAAG).
Awareness. Types of IP crimes. The criminals who commit these crimes. Impacts and dangers.
Investigation. Online and traditional techniques. Working with brand experts and the private sector. Large amounts of evidence. Resources.
Statutes. Prosecutorial theories. State-specific discussion.
Hands-on experience. Work with real counterfeit products. Identify fakes with expert guidance.

DF101 Basic Digital Forensic Analysis: Windows Acquisition

This course provides the fundamental knowledge and skills required to acquire forensic backup images of commonly encountered forms of digital evidence (Microsoft Windows based computers and external storage devices) in a forensically sound manner. Presentations and hands-on practical exercises cover topics on storage media and how data is stored, the forensic acquisition process, tool validation, hardware and software write blockers, forensic backup image formats, and multiple forensic acquisition methods. Students will use third party tools, both free and commercial, that are currently used by practitioners in the field.

DF330 Advanced Digital Forensic Analysis: iOS & Android

This course provides the advanced skills and knowledge necessary to analyze data on iOS devices (iPod Touch, iPhone, and iPad) and Android devices at an advanced level. Students use forensically-sound tools and techniques to analyze potential evidence, employing advanced techniques to uncover evidence potentially missed or misrepresented by commercial forensic tools. Topics include identifying potential threats to data stored on devices, available acquisition options, accessing locked devices, and the default folder structure. Core skills include analyzing artifacts such as device information, call history, voicemail, messages, web browser history, contacts, and photos. Instruction is provided on developing the hunt methodology for analyzing third party applications not supported by commercial forensic tools.

Mobile device hardware fundamentals. How mobile devices work, store data, and interact with a variety of networks.
Device handling. Properly preserving data for imaging and analysis. Identifying potential threats to data integrity.
Device acquisition and security. Acquisition options (physical, logical, device backups). Bypassing passcodes and properly defeating encrypted backups of iOS devices.
Advanced analysis techniques. Mounting images, partitioning scheme and default folder structure, types of artifacts (plists, SQLite databases, etc.).

DF100 Basic Digital Forensic Analysis: Seizure

This course introduces the information and techniques law enforcement personnel need to safely and methodically collect and preserve digital evidence at a crime scene. Topics include recognizing potential sources of digital evidence; planning and executing a digital evidence-based seizure; and the preservation, packaging, documentation, and transfer of digital evidence.

*Prepare. Prepare to respond to an incident or crime scene where digital evidence may be present.
*Identify. Learn tow to identify relevant sources of digital evidence in an ever-evolving landscape.
*Collect. Learn the proper methods of digital evidence collection.
*Preserve. Build upon the three previous principles to ensure valid and legal preservation of digital evidence can occur.

DF201 Intermediate Digital Forensic Analysis: Automated Forensic Tools

This course provides students with the fundamental knowledge and skills necessary to perform a limited digital forensic examination, validate hardware and software tools, and effectively use digital forensic suites and specialized tools. The course begins with a detailed study of the digital forensic examination process, including documentation, case management, evidence handling, validation, and virtualization. Students learn to use today's leading commercial and open source digital forensic suites: Magnet Axiom, X-ways Forensic, and Autopsy. Instruction on each suite will include an interface overview, configuration, hashing, file signature analysis, keyword searching, data carving, bookmarking, and report creation.

*Digital forensic process. Evidence review; requests for examination; case management.
*Validation. Creation of validation images; validation testing.
*Effective tool usage. Tool interface; hashing; file signature analysis; data carving; searching; metadata; bookmarking.
*Reporting. General report structure; report templates; using tool-generated reports.

Did I Do That? An Introduction to Mobile Device Artifact Research and Testing

Have you ever wondered how the forensic tools you use, know what they do? Have you ever wondered what an artifact means and why the 0 indicates a call was missed? Join NW3C High-Tech Crime Specialist Chris Atha as he introduces how to find these answers. Chris will break down the basics of setting up a mobile test device and performing basic differential testing using an iOS device. These steps will be performed using various free and open source tools, which students can use to follow along.

The Importance of Social Support and Interpersonal Relationships in Officers' Mental Health

Join Erin Craw as she explains the benefits of social support in mitigating the adverse effects of stress on officers' health and wellbeing. Dr. Craw will also discuss ways to support officers on and off the job. This webinar will also include recommendations and guidance for having difficult conversations with family members.

Searching for the Digital Evidence in Your Physical Crime Scene: Part 1

Early identification and recovery of digital evidence are critical for an investigation, and the amount and types of technical evidence have grown exponentially. This webinar will discuss digital "footprints" that can help you during your investigations, regardless of your technical background. We will discuss victim-based, suspect-based, and location-based ways of finding evidence to include innovative ways of seeing a crime scene through different technologies. Remember, even though your suspects device did not "connect" to anything, it likely did leave a trail on the victims device, nearby routers, or may have been collected by tech companies. This webinar is designed for investigators, prosecutors, crime analysts, or those who generally investigate crimes. No high-tech background is needed! Though it is recommended, you do not need to attend part 1 to attend part 2.

NDCAC Resources for Law Enforcement in the Digital Age

The NDCAC is a national center established under the Department of Justice designed to help facilitate technical knowledge management, and to foster the sharing of solutions and know how among law enforcement agencies. Their mission is to strengthen law enforcements relationships with the communications industry, leverage and share the collective technical knowledge and resources of the law enforcement community, and address challenges posed to law enforcement by advanced communications services and technologies. This one-hour webinar will introduce you to the many resources available through the NDCAC to include technical solutions, training, tools, and analytics.

Pages