Digital Forensics Courses

All courses are not offered every semester.

Advanced Computer Forensics – FRN 7873 (16 Hours)

Prerequisite: Intermediate Computer Forensics

This course builds on the proficiency of forensic examiners. More focus will be given to more difficult practical exercises where you will forensically search for emails, internet history, and use advanced searches using forensic software. Our Intermediate Computer Forensic course is a pre-requisite unless you are already an experienced forensic examiner. This course is designed to make you find more difficult files and data while improving your current skills. You will produce reports for court testimony that will describe deleted disk space and other technical strategy used to enhance the testimony. Chain of custody forms and varied presentations to prosecutors will enhance your skill. Through live Live scenarios, you will learn more difficult techniques in finding important evidence in a timely matter. Upon completion of this course, you should be able to: recognize and evaluate more difficult forensic searches. build expertise in all areas of examinations to improve reports and testimony, and overall knowledge of forensic exams.

Instructor: Steve Rose

Intermediate Computer Forensics – FRN 7872 (32 Hours)

Prerequisite: Introduction to Computer Forensics

The Intermediate Computer Forensics course builds on the concepts covered in Introduction to Computer Forensics. You should already be familiar with acquisition of data and imaging processes on Microsoft-based operating systems. This course covers some of the more advanced features of operating systems, including the forensic capturing of volatile memory. The course also examines operating system behavior and its forensic significance. You will receive hands-on experience working with NTFS examination tools. The course focuses on the analysis and reporting functions of computer forensics. You will build proficiency by using advanced analysis tools and techniques, and developing the reporting mechanisms of a computer forensic examination.

Instructor: Steve Rose

Introduction to Alternate Data Acquisitions – FRN 7957 (24 Hours)

This course will provide the foundational information needed to solve basic data acquisition problems using non-proprietary software. You will have hands-on experience with various methods used to root android mobile devices. We will introduce Odin, a new program that will better assist law enforcement when working mobile forensic cases. The Android Debug Bridge (ADB) will be used to communicate with the devices in conjunction with the android repair software, Odin. You will learn about different automated rooting methods, different tool validation methods, and courtroom acceptability of new software. 

Instructor: Chad Day

Introduction to Computer Forensics – FRN 7871 (32 Hours)

Before a digital investigator can be effective, he or she must have sufficient education and training. This course provides these fundamentals ensuring a solid foundation on which to build. Topics covered include definitions, evolution of computers and computer forensics, numbering systems and metadata.  Students will study the logical and physical aspects of hard drive data storage.  Data hiding techniques such as Steganography and Alternate Data Streams will be introduced. Using practical exercises, we will explore data authentication and finally practice creating forensically sound image copies of various digital media.

Instructor: Steve Rose

Level 1: Mobile Device Forensics – FRN 7865 (16 Hours)

This vendor neutral training will introduce the student to the dominant cell phone technologies currently used throughout the U.S. and overseas - GSM and CDMA/TDMA. Upon acquiring a basic understanding of the various systems and their functions, the student will then be introduced to the various data fields contained on handsets (CDMA/TDMA/GSM) and SIM cards (GSM only).  An explanation of how the various data fields can be recovered and the importance of these fields to the examiner will be covered. Upon acquiring a basic understanding of the various systems and their functions, the student will then be introduced to the various data fields contained on handsets (CDMA/TDMA/GSM) and SIM cards (GSM only).  An explanation of how the various data fields can be recovered and the importance of these fields to the examiner is also covered. Hands on practical exercises with our software and equipment will provide the student with experience on extracting data from cell phones.

Instructor: Cary Gordy

Level 2: Mobile Device Forensics – FRN 7906 (24 Hours)

This 3 day training will equip investigators, detectives, and law enforcement personnel with new concepts regarding mobile devices.  With over 45 million smart phones in the US, law enforcement must keep up with this technology to provide detailed and professional investigations. This course is a must for those interested in GPS and geotagging technology as it relates to investigative success. The information regarding Apple devices will enhance the investigators’ expertise.  Students will have hands on training with practical exercises using Cellebrite Units as well as Micro Systemation XRY Forensic Units to analyze various mobile devices. They are encouraged to bring their own phones or active cases where mobile devices are involved. There will also be a brief mobile phone overview so no pre-requisites or prior experience is required.

Instructor: Cary Gordy

Complete Digital Examiner: Level 1 – Extraction to Testimony – FRN 7958 (40 Hours)

This 40-hour course will provide foundational information necessary to complete an accurate, courtroom presentable, mobile forensic examination.  Students will learn about the basic network and mobile device operation.  The students will also learn how to perform basic logical and physical data extractions on Android and iOS devices.   The course will introduce students on how to validate equipment, how to write a report based on the information extracted from the mobile device as well as introduction to non-proprietary data recovery methods.  The class will conclude with a mock courtroom presentation and better prepare the officer on the proper way to testify on mobile device cases.

Instructor: Chad Day

Wireless Analysis Course – FRN 7956 (40 Hours)

This 40-hour training class is intended for Detectives, Investigators, and other Law Enforcement affiliated individuals that may need to survey or analyze information within a wireless environment.  Students will utilize commercially available hardware and open source software to conduct this type of analysis and investigation.  This unique class will introduce the different types of wireless technology, the flaws that surround wireless technology, and many different techniques in order to locate this information.  Reconnaissance involving war driving and walking will be discussed as well as the potential weaknesses that an investigator should look for.  Students will also learn about different types of exploitation to include Wi-Fi, ARP and MAC spoofing, as well as Bluetooth.  This specialized course will include multiple hands-on activities for the students to be involved with as well as face-to-face instruction from individuals that have a vast knowledge and experience within this field.

Instructor: TouchPoint International