Core Skills in Data Recovery and Analysis

Who Should Attend?


This course is designed for individuals who are setting out in the field of forensic computing or network investigation, or persons concerned in the investigation and prosecution of offences of a high tech nature.

Individuals should already possess a good understanding of computers and common software applications, and have a working knowledge of computer operating systems

Course / Module entry requirements


Individuals should already possess a good understanding of computers and common software applications, and have a working knowledge of computer operating systems.

No. of courses being run


2009/10 (full year): 4

2010/11 (full year): 4

Dates and Venues


 From: 19 Apr 2010  To: 30 Apr 2010
 Venue: Wyboston  Places: Available

 From: 07 Jun 2010  To: 18 Jun 2010
 Venue: Wyboston  Places: Available

 From: 11 Oct 2010  To: 22 Oct 2010
 Venue: Wyboston  Places: Available

 From: 14 Mar 2011  To: 25 Mar 2011
 Venue: Wyboston  Places: Available

Course / Module duration

10 days

Methods of delivery

The course follows a scenario of a computer investigation - from inception to Court - identifying evidential points and issues. Sessions are trainer led, comprising theory, demonstration and then hands on practical exercises for students to contextualise their learning.

Assessment process / accreditation details

The course is assessed (using both practical and theory assessments) at various stages, with an overall final practical and theory assessment providing evidence of learning, understanding and achievement.

Successful completion of this course will allow 20 credits to be obtained towards the MSc in Cybercrime Forensics offered by Canterbury Christ Church University.

Additional Information

Prices below current until 31 March 2011

For bookings and enquiries, please contact

Tel: 01480 401856
Email: 
enquiries_hightechcrime@npia.pnn.police.uk

Cost to HO Forces

£2511 Residential

£1523 Non-Residential

Cost to non HO Forces

£N/A Residential


£N/A Non-Residential

Overview


Computers are commonplace in homes & businesses worldwide. Evidence of criminality exists on many computers and requires sound methods of seizure, interrogation and presentation.

This two week course provides computer crime examiners with the skills to unlock this wealth of material & place it in the judicial arena.

Aims


To equip investigators, prosecutors and support staff with the core skills necessary to undertake, investigate and prosecute offences involving a high tech element.

Objectives


  • Recognise computer & other digital media that can store evidence
  • Interpret the process by which computer based evidence is seized, stored and interrogated
  • Explain the workings of a computer and how data is stored on computer media
  • Describe the process used to define media structures, including hard disks, floppy disks, solid state media, CD & DVD
  • Outline how FAT & NTFS file systems store their data and how deleted files are dealt with in each
  • Summarise the temporary files & other evidential artefacts that are created by computer use, and their evidential use
  • Explain encryption as it affects forensic examination and how law enforcement can make inroads into defeating it
  • Apply the learning developed on the course to the work place through the use of scenarios in identifying, investigating, recording & presenting digital evidence
  • Explain how computer evidence can best be put before Courts and how to present that evidence.