Core skills in data recovery and analysis

Seizure, interrogation and presentation of computer, digital device and electronic storage media.

Computers, digital devices and electronic storage media are present in homes and businesses worldwide.

Evidence of criminality exists on many computers and digital devices which requires sound methods of seizure, interrogation and presentation.

This course provides forensic computer examiners with the skills to unlock this wealth of material and place it in the judicial arena and contains both theory and practical exercises.

Aim

To equip digital forensic examiners and investigators with the core skills in data recovery (electronic evidence) necessary to undertake, investigate and prosecute offences involving a high-tech element.

Objectives

After attending this course, the participant will be able to:

  • identify electronic devices, digital storage media capable of containing electronic evidence and have a better understanding of how these devices function and store information
  • explain and identify evidential artefacts stored on Windows operating systems
  • gain a better understanding of disk geometry and structures where different partitioning schemes namely GPT, dynamic disks and MPT are in use including, file systems namely FAT, NTFS and ExFAT

These will be explained in detail to assist understanding into how data is managed, making data recovery possible.

Methods of delivery

Teaching sessions comprise of theory, demonstrations and hands-on practical exercises for students to contextualise their learning into data recovery, and identifying evidential issues relating to electronic evidence.

Key details

Prerequisites

​Individuals should already possess a good understanding of computers and common software applications and have a working knowledge of computer operating systems.

Practitioner group

​This course is designed for individuals who are setting out in the field of forensic computing or network investigation. It should be considered the first step towards developing skills and knowledge required for the role of a digital forensic examiner.

Duration

10 days.

Accreditation
Yes
Accreditation notes:

The course is assessed with a theory and practical assessment providing evidence of learning, understanding, application and achievement.

Cost

Home Office forces (non-residential):

Tuition fee: £2,300.50 (prices valid from 1 October 2019 for courses from 1 April 2020 to 31 March 2021)

Course contact
Booking