Digital Forensics Concepts

Explore the details of digital device triage. Triaging a digital device is essential knowledge. Proper on-scene triage prevents the loss of volatile data and the collection of unnecessary devices. This module discusses capturing RAM, recognizing and dealing with encryption and destructive processes and triaging devices with a forensic boot media.

A look at hash values and hash algorithms. In this module, the student learns how to use hash values as a way to include or exclude files from an investigation. This includes a discussion of different types of hash algorithms and how to hash individual files versus hashing drives.

In this module, you'll explore the importance of creating a disk image. Forensic examiners need to be meticulous in their work to avoid cross-contamination when creating a bit-stream copy. This module explains the importance of sterilizing media, how to validate tools, proper application of the write-blocker and validating the forensic bit-stream copy.

Explore the details of keyword and grep searches. How to conduct a keyword search using automated tools and how to establish a keyword list is covered in this module. The student receives an overview of grep, as well as completing a grep search using an automated tool.

A look at network basics for the computer forensics investigator. This module describes what a network is, how it functions, what IP addresses are and an IP address’s function on the network. This module also explores what a MAC address is and why it is vital to network forensics. Internet protocols are also covered.

A look at the importance of reporting and peer review. Report writing and peer review are of utmost importance. In this module, the student examiner learns what information to include and what does not belong in a final report. The student views several example reports, as well as generates a report using forensic software.