Core skills in data recovery and analysis

Computers, digital devices and electronic storage media are present in homes and businesses worldwide.

Evidence of criminality exists on many computers and digital devices which requires sound methods of seizure, interrogation and presentation.

This course provides forensic computer examiners with the skills to unlock this wealth of material and place it in the judicial arena and contains both theory and practical exercises.

Aim

To equip digital forensic examiners and investigators with the core skills in data recovery (electronic evidence) necessary to undertake, investigate and prosecute offences involving a high-tech element.

Objectives

After attending this course, the participant will be able to:

• identify electronic devices, digital storage media capable of containing electronic evidence and have a better understanding of how these devices function and store information
• explain and identify evidential artefacts stored on Windows operating systems
• gain a better understanding of disk geometry and structures where different partitioning schemes namely GPT, dynamic disks and MPT are in use including, file systems namely FAT, NTFS and ExFAT

These will be explained in detail to assist understanding into how data is managed, making data recovery possible.

Methods of delivery

Teaching sessions comprise of theory, demonstrations and hands-on practical exercises for students to contextualise their learning into data recovery, and identifying evidential issues relating to electronic evidence.