CompuForensics for Computer Forensics Training


Computer Forensics Examiner
6-Week Basic
Live online

Computer Forensics Examiner
6-Week Advanced
Live online

Onsite Training
Forensic Examiner
combined available

Computer Forensics Examiner
6-Week Bas.+Adv.
Live online accelerated

Length:    50 hours (5 CEUs)
Included:   Study materials/CD
Requisite:  Windows literacy
Summary:  This introduction to computer forensics includes Windows forensic hardware (WS, notebook & write blocks), software (i.e., WinHex and FTK) as well as search, evidence and Internet.
Length:     50 Hours (5 CEUs)
Tuition:     $495

Included:   Study materials/CD/DVD
Requisite:  Basic or equivalent
Summary:  Advanced analysis of Windows and Mac OSX computers employs Windows and Linux. Also included are  hidden data and encryption, technical investigative reports and court/legal issues.

Length:     3 Weeks (10 CEUs)
Call for pricing
Included:   Study materials/CD/DVD
Requisite:  Windows literacy
Summary:  Computer Forensics Examiner Basic and Advanced together onsite 8 hours a day, 5 days a week at a university campus or customer installation. Dates must be coordinated well in advance.

Length:     100 Hours (10 CEUs)
Tuition:      Call for pricing
Included:   Study materials/CD/DVD
Requisite:  Windows literacy
Summary:  Computer Forensics Examiner Basic and Advanced together at twice the normal pace (4 hours a day, Monday through Thursday). Dates must be coordinated well in advance.

Computer forensics is a relatively new professional endeavor within the computer science field. Little more than three decades old, it has garnered increasing attention in recent years due to an unusually high earning potential that tends to be almost immune from interstate, let alone overseas, competition. Computer forensics is the process of acquiring computer based information for use in legal proceedings or formal debate through a detailed or careful search. Legal proceedings normally refer to criminal or civil court trials, which are local in nature and therefore more effectively served by local examiners. Computer forensics, which was initially restricted to law enforcement officers, has more recently been practiced by those without law enforcement training. As such, it is increasingly popular among other computer professionals whose job prospects have been adversely affected by global competition.

Once you’ve decided you’re ready to embark on a career in computer forensics, enroll in our 6-week Basic or Advanced Examiner live online courses through the University of Texas at Arlington (UTA). Press the Home key above to find university contact and enrollment information in the upper right hand corner of the index page. Classes occur from Monday through Thursday. Afternoon classes meet from noon to 2:00 p.m. and evening classes from 6:00 p.m. to 8:00 p.m.; all times are US Central. Since Linux is employed to safely and effectively analyze Mac OS systems, possession of a Mac computer system is not needed.

Established in 1998, CompuForensics has long been popular among law enforcement, government intelligence and corporate security professionals. Previously restricted to full-time government employees or a select group of corporate security investigators, this high quality computer forensics training is now available to the general American public through nationally renowned and regionally accredited state universities and colleges. Those successfully completing at least 70% of scheduled Basic and Advanced classes, including a comprehensive forensics case study, are rewarded with a certificate signed by a dean or comparable official. Although designed as a 10.0 CEU (Continuing Education Units) university course with Pass/Fail grading, a university proctored written examination may be available for those requiring a letter grade. Course graduates can also elect to have their contact and training information listed on the Analysis page of this website.

Depicted to the right is the user friendly web based video access interface on one of our two multimedia password protected Examiner course websites. The student has access to these sites for the entire course, including web compatible read-only videos. Each large green button in the left frame corresponds to a Flash implemented MS Power Point presentation augmenting live instruction via Skype VOIP (Voice Over Internet Protocol). In addition to live sessions, instructor audio recordings may be accessed via blue buttons. Audio recordings are routinely made upon notification that a student will not be present for the live session. Alternatively, students can attend live lecture sessions via a land line or cellular telephone when unable to more fully participate. Telephone conference connections are facilitated via Skype or GoToMeeting.

The 50-hour 6-week Basic Examiner course is intended for those new to computer forensics, but capable of loading and operating Windows. This introductory course provides an inexpensive vehicle to not only prepare for more advanced and challenging technical training, but also to better assess your aptitude for an increasingly competitive and demanding computer forensics career. This introduction to computer forensics includes Windows forensic hardware (workstation, notebook & write blocks), software (i.e., WinHex, FTK and other discrete utilities) as well as onsite searches, evidence collection and storage, and Internet investigations.

Completion of the Advanced Examiner course provides the technical training necessary to begin doing computer forensics. Unlike lesser courses teaching use of a single largely automated forensics program, students learn to understand and effectively use manual and discrete Windows and Linux utilities to expertly analyze computers running Windows and Mac OSX.

 The DEFT Live DVD is the primary, albeit not exclusive, Linux forensic analysis platform. DEFT Live provides an excellent collection of forensic capture and analysis utilities for search site and off-site analysis. Lectures and laboratories provide a substantial background in locating and recovering hidden and encrypted data. A realistic week long forensics criminal case exercise tests your comprehension of lessons learned during the Basic and Advanced course. Using a suite of Linux office software, students learn to create professional technical reports of investigation and court exhibits. The last week prepares you to defend your findings in court based upon an understanding of legal and procedural precedents as well as validated expert testimony techniques. A web cam is recommended for use during the last day of class.

To accommodate our government or corporate customers, accelerated onsite variations of our Basic and Advanced Examiner courses are available. The onsite 100-hour combined course can be provided at the UTA campus or the customer's facility 7-8 hours a day over a 2-3 week period. Reduced pricing if affected by both the location and number of students. An accelerated online combined 100-hour course can be provided 4-hours a day for 6-weeks. Pricing is affected by the number of students.

The university scheduled live online Examiner courses are restricted to no more than nine students. Classes often tend to be smaller still, affording an unparalleled student-teacher ratio. Although scripted exercises are designed for independent use, the instructor is available should the student require immediate assistance during scheduled laboratory exercises.

Our Basic and Advanced Examiner courses are designed to equip government and private investigators/analysts with the skills needed to safely locate and secure computer evidence at the search site as well as to conduct subsequent off-site analysis. Select Syllabus to download a detailed listing of instructional topics contained in the two 50-hour courses. Linux, the world's most powerful operating system, is employed to more safely and effectively analyze Windows systems, including Windows 3.x, 9.x, ME, 2000, XP, Vista, Windows 7 and 8. This technique, increasingly used in the forensics community, was pioneered by the Department of Defense in the late 1990s. Frequently asked questions and a sample video interface is available by selecting the Questions button at the top of this page. Prospective students are also invited to contact the instructor by telephone or email.

Analysis is taught using both Windows and Linux. The current DEFT 8 Live DVD and earlier Knoppix (5.1.1) Live CD preclude inadvertent modification of target computers at or away from the search site. The use of a hardware write block is routinely employed to preclude Windows and Windows based analytic tools from writing to target (evidentiary) media. Below wholesale discounts for forensic write blocks is available to enrolled students. For those preferring to use Linux almost exclusively away from the search site, Code Weaver's CrossOver for Linux allows many Windows applications and forensic tools to run inside a wide variation of Linux distributions.

Online Forensics Instructor
The instructor possesses professional training and experience second to none. Possessing bachelor and masters university degrees, the instructor additionally attended special agent academies for the Department of the Treasury, US Customs Service, Naval Criminal Investigative Service and USAF Office of Special Investigations. Applicable technical training was principally hosted by the Treasury Department and Central Intelligence Agency. A former field grade intelligence officer with the USAF and US Army, he is a decorated Vietnam air combat veteran. Retiring at age 53 with a quarter century of federal law enforcement experience, he served as field agent, agent supervisor and headquarters staff, including service as a national program manager for computer forensics. In addition to well over a decade of US Government computer forensics experience, he has taught computer forensics since 1999 at nine regionally accredited universities or colleges in the Midwest and South. Press Biography for a one-page instructor resume.

Forensics Examiner Student Background
All students should be fluent in English. All lectures, laboratories and videos are provided solely in English. The online format especially does not lend itself well to those with hearing or sight disabilities. Twelve week examiner students should minimally have prior experience in loading the Microsoft Windows operating system and applications, copying/moving/linking files using Windows Explorer, and be familiar with the use of classic menu options. Those intending to enroll in the Advanced course without first attending the Basic course should have prior forensics training and/or experience in addition to computer literacy approaching that of A+. Call if you have questions about your background for either the Basic or Advanced courses. Admission to the Advanced course without successful completion of the Basic course is contingent upon the approval of the instructor. Prior experience with Linux is not required for the Advanced course.

12-Week Examiner Computer System Requirements
Audio Headset - Use of an ear phone with an integrated microphone is required to avoid background noise and echo effects. Suitable head phones with integrated microphones are widely available for as little as $20. Student microphones should be muted when not used for talking.

Audio/Video Computer - A laptop, desktop or tower computer running Skype is recommended. A Flash supported tablet or comparable Smartphone should suffice during most lectures. The Flash presentation interface should be compatible with all major browsers supporting Flash 10.1 or later.  This interface has been successfully tested with Windows, Apple OSX and Linux, including Android tablets using 2.3.4 OS or higher; late Ice Cream and Jelly Bean Android tablets can be made Flash capable by downloading Flash Player  11.1 for Android 4.0 at the Adobe Flash archive website. To test Flash video compatibility, press Flash Test; if you can see the video, you're browser is Flash compatible. Skype teleconferencing software is available for Windows, Macintosh, Linux and Android operating systems. Download a free copy of Skype from GoToMeeting may replace Skype in some instances.Skype, owned by Microsoft and most likely more popular than all other VOIP alternatives combined, employs 256bit AES encryption. That does not mean that Skype is immune from potential abuse or monitoring. While any major US based VIOP or public switched telephone network is potentially subject to random US Government meta data and content monitoring in the post 9/11 world, a few steps can preclude the likelihood of unwanted access by non-Government parties via Skype. Consult to learn how to enhance Skype security within Windows. Quitting Skype when not needed may also be prudent. Additionally, the Skype icon on the left side of the index page provides a download link for the last pre-Microsoft/NSA version of Skype. To help preclude Skype from updating to a Microsoft/NSA version, despite update being disabled inside Skype, follow directions at the Skype forum. German based Uberconference is being tested as a replacement for Skype.

Advanced Exercise Computer
- Since the Advanced Examiner course involves some rebooting during online laboratory sessions, simultaneous use of a separate forensic exercise computer is recommended. The exercise computer should be minimally equipped with a DVD-ROM bootable drive. The exercise computer should minimally be configured with a Pentium IV or equivalent processor running at 1.6 GHz or faster, 2 gigabytes of RAM (Random Access Memory) and 30 gigabytes of free hard disk capacity. Use of RAID or unusually large drives is not recommended. While the exercise computer can be a notebook, use of a desktop or tower with at least one available removable drive bay is preferred for those intending to use their exercise computer to do computer forensics analysis at the conclusion of the course. The exercise computer should contain Windows Vista or Windows 7. DEFT 8 Linux will be installed during the initial weeks of the Advanced course. Instruction on how to install OpenSuSE Linux, the most popular business distribution, is available, however, most Linux forensics analysis is accomplished using DEFT 8 Linux. Code Weavers Crossover can be used to run Windows applications under many Linux distributions. Use of a virtual exercise computer on the Audio/Video Computer in lieu of a separate exercise computer is authorized with the understanding that support for virtual operating environments is limited to the VMware freeware Player. VMware Workstation and Player, as well as Oracle Virtual Box, have been used successfully by students in recent courses.

Exercise Software - Required Basic and Advanced preliminary and Advanced comprehensive forensic exercise images are available in Norton Ghost, SafeBack 3.0, WinHex and Active Disk Image formats. If used, Norton Ghost should be 2001, 2002 or 2003; Ghost 10 is the last version to include Ghost 2003. Possession of a personal or higher licensed version of WinHex disk editor is recommended for the Basic course; the specialist or higher license is recommended for those intending to do forensics after completion of the Advanced course. A personal license copy (about $50 US) will support most WinHex instruction requirements. The trial ware version of WinHex can be used with the understanding that several of the Basic course WinHex exercises will not be supported. Advanced students should optionally possess a bootable Knoppix 5.1.1 Live CD-ROM; download links for Knoppix 5.1.1 and OpenSuSE 11.1 are available at as well as  two high speed password protected FTP sites. FTP sites, which are restricted to current students, additionally contain ISO, exercise images and VMware virtual machines used during the Advanced course. Basic students are issued a CompuForensics bootable CD-ROM. Advanced students are issued the CompuForensics bootable CD-ROM as well as DEFT 8 Live and installable Linux DVD.

DEFT 8, an Italian forensics implementation based on Ubuntu, is the primary linux platform employed. In the graphic below, a Mac OSX exercise partition has been mounted in Read-only mode. Various Linux forensics utilities are then employed to effectively analyze and document the partition.

Scheduled CompuForensics Online Computer Forensics Courses

Mon thru Thu
Apr. 28 - Jun.  10

50-hr. 6-week Forensics Basic Examiner live online
M-Th, 6 - 8 p.m. Central Time
Observed holiday: None
Enrollment Open

Mon thru Thu
Aug. - Sep. 2014
Dates TBA

50-hr. 6-week Forensics Adv. Examiner live online
M-Th, noon - 2 p.m. or 6 - 8 p.m. Central Time
Observed holiday: Labor Day & Columbus Day
Enrollment Open

© CompuForensics     Home  Syllabus  Analysis  Links     Rev. April 08, 2014