Course Description:

This intermediate level course presents digital forensics instruction from a systems security perspective using a variety of software. Students participating in this class are exposed to drive image making, working with various PC and Mobile device hardware, and investigations of files and documents. Investigative techniques practiced in this class are performed in a secure environment. Students completing this class will be able to sit for the AccessData Certified Examiner (ACE) certificate and the AccessData Mobile Examiner (AME) certificate.

Outcomes:

1. Demonstrate the creation of a digital image of a physical storage device
2. Describe an appropriate evidence handling process
3. Using an existing report template, write a report of an analysis of digital evidence for a case
4. Using common digital forensics tools, demonstrate the technique for locating a variety of file types
5. Explain how deleted digital information can be recovered
6. Compare and contrast analysis differences between common computer operating systems
7. Demonstrate analysis techniques to open SAM, SYSTEM and SECURITY files
8. Describe how analysis of computer logs demonstrate attribution
9. Analyze various cases to determine digital actions of a user
10. Perform digital analysis of a mobile device