Digital Forensics & Electronic Discovery Training

ITS1301 - Digital Forensics & Electronic Discovery Training

Course description
The Boston University Corporate Education Center and Mile2 are working cooperatively to deliver training in digital forensics, counter hacking, disaster recovery, and intrusion detection. Mile2’s primary objective is to establish and contribute to a universal benchmark standard for adoption by government, military, and corporate organizations that are significant strategic objectives for the escalation of evildoers’ agendas.

It is widely accepted that "information is power". This becomes most apparent in a negative way when "evildoers" exploit unrestricted access to information, in order to escalate their agendas against the community. We have categorized "cyber-evildoers" into three main groups in order of the threat posed:

• Hackers motivated by hate (terrorists)
• Hackers motivated by greed (white-collar crime)
• Hackers motivated by a desire to commit vandalism

It is estimated that over 85% of all crimes committed today leave a trail of digital evidence. The Digital Forensics and Electronic Discovery (DFED) training course is designed to train “Cybercrime Investigators” in electronic discovery and the fundamentals of conducting an effective computer forensic examination. This course is essential to law enforcement and corporate personnel who encounter digital evidence while conducting an investigation. The training environment is interactive and the students work on case files in a hands-on environment. Upon completion of the course, students should have the knowledge to immediately use their new skills to conduct a computer forensic examination.

For related Boston University training, see the topics of wireless, CISSP, and network security.

Onsite or Group Training
This course can be tailored to meet corporate, government, and law enforcement organizational requirements. Consult with Boston University Training Consultant for more details.

Prerequisites

• Excellent computer skills using MS-Windows based software
• Must be willing to learn in a fast-paced, technically oriented environment

What you will learn

• Introduction to Computer Crime
  An introduction to the field of computer forensics and the basis for gathering electronic digital artifacts. Students will be introduced to the concepts, situations, and personalities they may encounter while investigating a computer incident. The origins of computer crimes and how they are discussed as well.

• Disk Storage Concepts
  Having a clear understanding of how data is stored is having the upper hand during any investigation. Microsoft operating systems have a systematic way of storing data that is unknown to most end users; here you will learn hard drive storage dynamics. Although information may not physically be visible, there are many different approaches to recovering or viewing the data that appears to be lost. DOS, Windows 3.x, 95/98/NT/2000/XP operating systems, and file management are discussed.
  
  
• Forensic Examination
  Techniques and protocols utilized by U.S. computer forensic examiners and laboratories are covered. This is a detailed review of standard and advanced procedures and how you can effectively implement these procedures into your organization. These proven techniques have been the most effective since the inception of computer crimes.
  
  
• Electronic Discovery and Digital Evidence
  Students will learn recovery methods of digital artifacts from various file structures. The footprints left behind with every keystroke will be covered. Exercises detail what to look for, as well as the various techniques for retrieving the information in a forensically sound manner.
  
  
• Tools of the Trade
  Multiple software and hardware solutions are covered during this session. Students learn about the numerous tools available to them in a vendor neutral environment. A clear understanding of what the tools do and how they work is presented in layman’s terms. Gaining a clear understanding of what forensic tools do and how they work is a crucial part of any investigation, especially if it goes to trial.
  
  
• Seizure Concepts
  Proper seizure of digital media is the start of every computer investigation. During this lesson, students learn the correct protocol, as set by the U.S. Department of Justice, to assure proper “Chain of Custody” is followed from the beginning of the investigation. This crucial information can make or break a case. First responders–must properly handle evidence and start the correct chain of custody.
  
  
• Cyber-terrorism and Internet Investigations
  Students are exposed to possible threats to their infrastructure and learn to effectively combat cyber-terrorism. National and corporate infrastructures are a target for terrorism because of the effects they have on the economy. These are hands-on exercises where students learn how to identify digital Internet artifacts left by potential cyber-terrorists. Students also learn pro-active measures to counter the threat of cyber-terrorism and conduct Internet-based inquiries.
  
  
• Electronic Discovery, Acquisition, and Analysis Lab
  Students acquire and analyze digital evidence using specialized forensic tools. Proper authentication and analysis skills are taught using advanced forensic utilities and software tools. This is a hands-on lab requiring students to utilize the proper tools and procedures to conduct a forensically sound examination of digital media. Students are required to properly authenticate and analyze digital evidence during this exercise.
  
  
• Presentation of Digital Evidence
  Students are introduced to aspects of presenting digital evidence in a courtroom environment. They are exposed to the specialized tools necessary to effectively create and present the results of a cybercrime investigation to an administrative body or court of law. Both civil and criminal incidents are covered during this lesson.
  
  

Students will receive the following items during the training program:

• A 300-page comprehensive computer forensic student guide and investigative resource materials.
• A CD-ROM containing GUI-based Windows data examination software with a " live" casefile.
• Upon passing practical and written exams, a Certificate of Certification.