Forensic Computer Examiner GES 305 » 80 hours

This program is compatible with the Windows XP and later operating systems and IE 7 and later browsers.

Minimum Computer Requirements:

• PC with the latest updates and BIOS (Mac computers may not be used)
• XP, Vista or Windows 7 operating systems
• Internet access
• 1 GB (or more) memory
• 10 GB or larger hard-disk drive for examination purposes
• 2 (or more) open USB 2.0 ports

Recommended Configuration:

• PC with the latest updates and BIOS
• Windows 2000 or XP operating system
• High-speed Internet access
• 2 GB (or more) memory
• 15 GB or larger hard-disk drive for examination purposes
• Integrated PS/2 ports (not USB keyboard or mouse)
• 4 open USB 2.0 ports
• 1 open Firewire/IEEE 1394 port
• Read/Write blocking device such as the FireFly Read/Write device made by Digital Intelligence

You may use either a desktop or a laptop computer.

This program is based on the concept of teaching computer forensics from a vendor-neutral perspective, and you’ll learn the low-level mechanics of commonly encountered file systems. If you can gain a solid understanding of one file system and how it functions at a low level, then you’ll be prepared to learn other file systems as well.

This program material also teaches low-level mechanics and functions of both the FAT file system and the New Technology File System (NTFS). Although the FAT file system is not available on new computers, it’s the default file system on floppy diskettes and USB devices. Many computer forensic incidents involve USB devices and will continue to involve these devices for years to come. Consequently, students studying to become successful forensic computer examiners must understand the FAT file.

Windows 98 and earlier versions are based on the FAT file system. A computer formatted with Windows 2000, XP, and Vista versions will typically be formatted with the NTFS file system.

The completion of several practical exercises is a requirement of this program. Some might include floppy diskettes. Although the floppy diskette is no longer commonly encountered in the field, keep in mind that it’s the exercise that is significant, and any action taken on a floppy diskette can be replicated on a hard drive.