Digital Evidence

FRN 7864 Advanced Identity Theft and Electronic Crimes ONLINE CLASS

Instructors: Dale Callan, AAAF-Staff
This course is an advanced course on all facets of Identity Theft which will emphasize the use of electronic crimes and the internet investigations involving Identity Theft. Students will cover the major issues including credit card, bank and financial crimes relating to these investigations. The class will discuss and identify phishing schemes and other social engineering tactics used by criminals today. Many investigative techniques used by federal agencies to catch these thieves will be covered in detail. Students will use computers to learn more internet search engines and other techniques and receive software that will assist their investigations. Extensive video’s, online investigations and the US Secret Service electronic crime training will be used. This is a must course for any investigator involved with financial crimes and internet investigations.

FRN 7879 Best Practices for Seizing Evidence

This Online course is primarily for First Responders but is also a good review for experienced investigators when it comes to seizing digital evidence. The course covers the seizure of both home and network computers. Details involving safe handling of cell phones, PDA’s, storage media and camera’s are also covered. The course discusses the potential digital evidence found in computer logs, documents, address book lists and other areas of the computer where evidence can be found. Standard operating procedure for safeguarding evidence when seized and transported is covered in this course. Investigative questions for targets and victims are reviewed. The course is an excellent source of guidelines used for search warrants.

FRN 7865 Cell Phone Forensics- 16 hours

Instructors: Chris McNeil, Charlotte Mecklenburg Police Department
This vendor neutral training will introduce the student to the dominant cell phone technologies currently used throughout the U.S. and overseas - GSM and CDMA/TDMA. Upon acquiring a basic understanding of the various systems and their functions, the student will then be introduced to the various data fields contained on handsets (CDMA/TDMA/GSM) and SIM cards (GSM only).  An explanation of how the various data fields can be recovered and the importance of these fields to the examiner will be covered. Upon acquiring a basic understanding of the various systems and their functions, the student will then be introduced to the various data fields contained on handsets (CDMA/TDMA/GSM) and SIM cards (GSM only).  An explanation of how the various data fields can be recovered and the importance of these fields to the examiner is also covered. Hands on practical exercises with our software and equipment will provide the student with experience on extracting data from cell phones.

FRN 7867 Computer Crimes Against Children

Instructors: Special Agent Phil Osborn, Department of Homeland Security and Detective Tom Kolpacki, Ann Arbor Police Dept, Michigan
This course focuses on child exploitation issues and the Internet. Students will learn how to capture evidence of online abuse of children. The course covers technical investigative procedures that are used to capture online child predators. Practical experience in class includes the use of free tools and the Internet; in addition, students will also learn how to establish investigative units online. Child exploitation laws, evidence and search warrant issues will also be covered.

FRN 7861 Digital Evidence Courtroom Testimony

Instructors: Various Assistant US Attorneys and Assistant District Attorneys
This course provides an assessment of what to expect in the courtroom when a digital evidence case is involved, as well as the requirements for delivering expert testimony. It covers the current status of forensic digital evidence from both the scientific and legal perspectives in both criminal and civil cases. Students will see a mock trial for both types of cases, including an expert witness providing testimony for digital evidence. Students will also see the process of qualifying an expert in court by prosecution and defense. During the case mock trials, students will receive the opportunity to role play in qualifying the expert by asking questions that can open discussions about what to anticipate in the courtroom. Students will learn to identify and have an opportunity to discuss prospective issues and their potential resolutions regarding digital evidence investigation, examination, laboratory accreditation, and use at trial.

FRN 7860 Hardware Fundamentals for Law Enforcement

Instructor: Majid Hassan, High Technology Crime Investigation Association
This course is a prerequisite to any computer forensics course at the American Academy of Applied Forensics. It is an introduction to basic hardware concepts of PC systems and provides an intense coverage of computer hardware and the functionality of the inner components. Students will learn to recognize and manipulate the main components of a typical PC and understand their functions. They will disassemble a computer in its entirety and rebuild it from the motherboard up. Students will also build a PC from scratch and load the operating system. By the end of class, students will be well versed in the basic functions of major PC hardware and component technology and be able to build a computer in class. Successful completion of this course prepares students to pursue training in computer forensic examination that requires a thorough knowledge of hardware components.

FRN 7863 Financial Terrorism

Instructors: Majid Hassan, Tony Marino and Dale Callan
This course covers financial crimes, their relationship to terrorism and the resulting digital evidence that is created. Students will learn how terrorism has been funded using typical financial transactions as well as illegal methods of securing funds. The course will cover financial crimes including identity theft, phishing, money laundering, etc., and their role in global crimes that result in threats to people, infrastructure and geography. Students will learn the investigative approach necessary to follow the trail of digital evidence left behind by financial crimes that fund terrorism.

FRN 7866 Introduction to Cybercrimes

This course provides a basic understanding and a review of cybercrimes. Internet related electronic crimes, their background and how they affect the public and law enforcement today are covered in this lecture course. Terrorist issues, the roles of federal law enforcement, regional task forces and cyberspace as a target are covered. Computer evidence and prosecutive issues will provide the student with a good overview of cybercrimes. This class will set a foundation for other electronic crime and online investigatory classes.

FRN 7868 Preliminary Computer Investigative Techniques-24 hours

Instructor: Steve Hickey, EnCE, American Academy of Applied Forensics, Charlotte, NC
This course is designed to provide the student with a basic knowledge of how a computer works, how the Internet works and additional topics investigators may need to more effectively operator a computer. Topics will include MS Word areas, multi-media use, windows basics, installing new programs and email along with an overview of Excel and Powerpoint . Students will go on class computers and do practical exercises to enhance their computer knowledge and skills from basic copying, scanning, learning to be more organized, loading software, copying and pasting and finding keyboard shortcuts. Internet details will involve browsing concepts, hperlinks, searching and finding favorites, history along with a basic understanding of connections, wireless and background information. After completion of this course law enforcement investigators will be able to handle simple computer investigations, organize cases and evidence and be able to save appropriate documents for future needs.

FRN 7869 Digital Search & Seizure for Patrol Officers

This course is a combination lecture course which sets an overview of digital evidence and the variety of electronic storage media that may be found or observed during vehicle stops and searches. Students will obtain a brief outline of search and seizure guides and consent search issues and then participate in practical search exercises of vehicles which will contain numerous items of digital evidence. This class will provide patrol and investigative officers an excellent overview of digital evidence found in vehicles today.

FRN 7870 Search & Seizure of Electronic Evidence

Instructors: Various North Carolina Police Departments
This course is an introduction to electronic media devices (computers, cell phones, PDAs, etc.) and the mechanics of seizing them. Students will explore innovative hardware technology used to commit computer-related crime and the legal ramifications of searching electronic media. Class includes extensive practical exercises in the search and seizure of electronic media in various crime scenes. Upon completion of the course, students will be able to recognize electronic evidence, build a search warrant for a digital evidence case, properly search and seize digital evidence in a crime scene, properly document property seized in an electronic crime scene, and properly submit and safeguard integrity of digital evidence for a laboratory examination.

FRN 7871 Introduction to Computer Forensics

Instructor: Steve Hickey, EnCE, American Academy of Applied Forensics, Charlotte NC

Prerequisite: FRN 7860 Hardware Fundamentals for Law Enforcement or equivalent experience

Before a digital investigator can be effective they must have sufficient background education and training.   This course provides these fundamentals ensuring a solid foundation on which to build.  
Topics covered include definitions, evolution of computers and computer forensics, numbering systems and metadata.  Students will study the logical and physical aspects of hard drive data storage.  Data hiding techniques such as Steganography and Alternate Data Streams will be introduced. Using practical exercises, we will explore data authentication and finally practice creating forensically sound image copies of various digital media.

FRN 7872 Intermediate Computer Forensics

Instructor: Steve Hickey, EnCE, American Academy of Applied Forensics, Charlotte NC

Prerequisite: FRN 7871 Introduction to Computer Forensics

The Intermediate Computer Forensics course builds on the concepts covered in Introduction to Computer Forensics. Students should already be familiar with acquisition of data and imaging processes on Microsoft-based operating systems. This course covers some of the more advanced features of operating systems including the forensic capturing of volatile memory. The course also examines operating system behavior and its forensic significance. Students will receive hands-on experience working with NTFS examination tools. More focus is given in this course to the analysis and reporting functions of computer forensics. This course focuses on building the proficiency of the forensic examiner by using advanced analysis tools and techniques, and developing the reporting mechanisms of a computer forensic examination.

FRN 7873 Advanced Computer Forensics

Instructor: Steve Hickey, EnCE, American Academy of Applied Forensics, Charlotte NC

Prerequisite:FRN 7872 Intermediate Computer Forensics

This course builds on the proficiency of forensic examiners. More focus will be given to more difficult practical exercises where the student will forensically search for emails, internet history and use advanced searches using forensic software. Our Intermediate computer forensic course is a pre-requisite unless the student is already an experienced forensic examiner. This course is designed to make forensic examiners find more difficult files and data while improving their current skills. Students will produce reports for court testimony that will describe deleted disk space and other technical strategy used to enhance their testimony. Chain of custody forms and varied presentations to prosecutors will enhance the examiners skill. Live scenarios will be used to learn more difficult techniques in finding important evidence in a timely matter. Upon completion of this course, students should be able to: Recognize and evaluate more difficult forensic searches. Build their expertise in all areas of examinations so they are able to improve reports and testimony and overall knowledge of forensic exams.

FRN 7880 Credit Card Fraud & Digital Evidence

This Online course will introduce the student to all types of credit card frauds but will concentrate on digital evidence and computer issues. The course will cover phishing, data mining, ATM fraud, ID Theft related fraud with credit cards along with various computer-cybercrime fraud. The course will cover investigative tips and sources for gaining information and assistance for investigators. A discussion on state and federal credit card violations will assist the investigator in determining the best statutes to use and how they fit the crime. New technology on no swipe cards and the differences on debit vs credit type cards is also covered. This class is a must course for financial crimes and credit card investigations.

FRN 7874 Internet as an Investigative Tool

Instructor: Steve Hickey, EnCE, American Academy of Applied Forensics, Charlotte NC
This course provides a comprehensive coverage of cyber crime. It covers various Internet crimes as well as traditional crimes that are facilitated by the Internet. Students will learn investigative tactics for various types of cyber crime including, but not limited to: fraud, identity theft, hacking, piracy, child exploitation, e-mail, illegal drugs and narcotics crimes, domestic and international terrorism, stalking, money laundering and financial crimes. This class involves hands-on activities that will allow each student to use the various investigative software, tools and utilities provided in class.

FRN 7875 Online Investigations

Instructors: Steve Ingram, Detective, Davidson Police Dept, Dale Callan, AAAF-Staff & Steve Hickey, InSight Forensics, Charlotte
This course is an introduction to cyber crime and the study of network forensics. Using the Internet as an investigative tool, the course focuses on the basics of networking and inter-networking. Students will learn the types of attacks that exist in cyber crime, how these attacks are performed and how law enforcement can trace the origin of this criminal activity. Cyber crime tactics covered are virus creation (including Trojan horses), web and database hacking into business and personal systems, network sniffing and/or network spying, encryption, etc. Students will also learn the kind of information that can be compromised during a network attack. In addition, students will learn to trace e-mails and computer IP addresses to begin an investigation of cyber-criminal activity.

FRN 7876 On-Scene Computer Forensics

Instructor: Gary R. Cullop, North Carolina State Bureau of Investigation
This course provides an introduction to live computer forensics. It covers recognized tactics used at the crime scene to view computer-use activity prior to seizure. Students will learn how to view the contents of a computer prior to seizure without actually altering information on the machine. The course uses Linux utilities that can be used on a Windows-based machine and provides an introduction to the Linux Operating System. Students will obtain hands-on experience working with similar incident response tools. The course also covers the legal issues of searching a computer prior to seizure along with consent-to-search protocols. Students should know how to use a PC and have basic knowledge of computer systems.

FRN 7878 Digital Evidence Expertise in the Courtroom

This Online course provides an assessment of what to expect in the courtroom when a digital evidence case is involved, as well as the requirements for delivering expert testimony. It covers the current status of forensic digital evidence from both the scientific and legal perspectives in both criminal and civil cases. Students will see suggestions from prosecutors on testimony relating to digital evidence. Students will also see the process of qualifying an expert in court by prosecution and defense. You will see breakdowns, explanations and easy charts explaining the different media and binary terms. This course will prepare all law enforcement officers with a good basic understanding of digital evidence expertise including digital media terms, computer forensic terms and general strategy for good testimony involving computers and other digital media.

FRN 7881 Investigation of Social Networking Sites

This unique Online course will cover the most commonly used social networking sites today. Information about the site profile, how to review and peruse the site and the latest statistical information will be covered. Sites like Myspace, Facebook, Twitter, and others are reviewed and discussed so the student can become more familiar with the shortcuts, potential evidence and dangers of some of these sites. The course covers cyber stalking, cybercrimes and IP addresses along with other investigative tips. Contact information for subpoena’s, email addresses and fax numbers for these sites will also help the investigator learn more about investigations involving social networking sites.

FRN 7890 Detecting Terorists Uses of Technology

Instructor: Steve Hickey, EnCE, American Academy of Applied Forensics, Charlotte NC

Enrollment in this class is limited to active, sworn Law Enforcement officers only.

Prerequisite: Students must have basic, user-level experience with a Windows-based computer along with the ability to retrieve information from the Internet.