• • 
•  
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

Forensic Computer Examiner

GES 305 -- 150 hours

Course Objectives

After successful completion of the Forensic Computer Examiner online program, students will:
• Understand what makes an examiner a good examiner.
• Be able to explain to clients why trained forensic examiners should be used.
• Understand what a forensic examiner may expect to encounter during an examination.
• Understand software licensing and how it affects forensic examiners.
• Understand forensic ethical standards as they apply to forensic examiners.
• Understand basic forensic examination procedures.
• Be able to prepare and verify forensically sterile examination media.
• Understand the importance and methodology of note taking and reports.
• Understand basic PC hardware identification.
• Have a basic understanding of the legal privacy issues relating to the examination of magnetic media.
• Understand when a legal opinion may be necessary to prevent privacy issues from interfering with the examination or causing a valid lawsuit.
• Have a basic understanding of how to properly acquire, collect, or seize magnetic media.
• Understand how to properly establish and maintain the physical "chain of custody" of media and evidence.
• Make exact forensic copies of original floppy-diskette media.
• Understand the logical structures of DOS and Windows 95/98
• Understand where the creation and modification dates and times are stored in a directory entry.
• Understand the significance of the creation and modification dates and times.
• Understand how to recover data from unallocated space.
• Understand and explain how files are created.
• Understand and explain what happens when a file is deleted.
• Understand, explain and manually recover DOS legal single and multiple cluster deleted files.
• Understand, explain and manually recover DOS legal multiple cluster fragmented deleted files.
• Understand how to determine the Last Accessed Date and the Modification Date and Time, their significance and when they are modified.
• Understand how Windows long file names are stored, what happens when they are deleted and how to restore long file names.
• Understand how sub-directories are stored, what happens when they are deleted and how to recover deleted sub-directories.
• Understand what happens when a diskette or hard-disk drive is formatted and how to recover files, sub-directories, and data from formatted disks.
• Understand the NTFS partition table, boot record, and root directory.
• Understand Bitmaps.
• Understand the MFT.
• Understand NTFS Headers and Attributes.
• Understand Resident and Non-resident files.
• Understand Run lists, etc.
• Understand Alternate data streams.
• Understand NTFS File storage.
• Understand the various dates and times stored in attributes.
• Understand File deletion and recovery.
• Understand Directory storage.
• Understand Tracing files/directories.
• Understand the NTFS registry "hive."
• Understand Examining NTFS drives.
• Understand the basic imaging methods and how to make "exact copies" of media.
• Understand the significance of, location of and how to recover data from swap files, temporary files, Internet cache files, Internet cookies, mail files and Internet sites visited.
• Understand basic Internet issues such as, doing a basic "whois."
• Understand how to preserve the original media.

• Understand how to prevent inadvertent writes. • Understand how to prevent virus introduction and how to prevent activation of "booby traps." • Understand how to safely handle media. • Understand how to find and document normal data and graphical files. • Understand how people commonly try to hide data. • Understand how to find and document data in unallocated space. • Understand how to find hidden data. • Understand password protection schemes and how to lock and unlock many passwords. • Understand how to access MS Word metadata. • Understand the basic use of automated forensic suites (FTK). • Understand basic data formats and types. • Understand how to conduct basic data-format conversions. • Understand the basic issues in examining CDR media. • Understand how to present recovered and evidence data to the client in a useful format. • Understand how to manage data. • Understand how to present data in court or other proceedings in a clear and understandable manner. • Have conducted an examination of a hard disk drive that covers the full range of forensic issues found in this training course. • Be fully prepared to sit for the CCE Certification testing through the International Society of Forensic Computer Examiners.