CompuForensics for Computer Forensics Training

HOMEFAQ (Tablet)SYLLABUSANALYSIS

Computer Forensics Examiner
6-Week Basic
Live online

Computer Forensics Examiner
6-Week Advanced
Live online

Onsite Training
Forensic Examiner
combined available

Computer Forensics Examiner
6-Week Bas.+Adv.
Live online accelerated

Length:    50 hours (5 CEUs)
Tuition:     
$449
Included:   Study materials/CD/DVD
Requisite:  Windows literacy
Summary:  This introduction to computer forensics includes Windows forensic hardware (WS, notebook & write blocks), software (i.e., WinHex and FTK) as well as search, evidence and Internet.
Length:     50 Hours (5 CEUs)
Tuition:     $499 ($599 w/o Bas.)

Included:   Study materials/CD/DVD
Requisite:  Basic or equivalent
Summary:  Advanced analysis of Windows and Mac OSX computers employs Windows and Linux. Also included are  hidden data and encryption, technical investigative reports and court/legal issues.

Length:     3 Weeks (10 CEUs)
Tuition:    
Call for pricing
Included:   Study materials/CD/DVD
Requisite:  Windows literacy
Summary:  Computer Forensics Examiner Basic and Advanced together onsite 8 hours a day, 5 days a week at a university campus or customer installation. Dates must be coordinated well in advance.

Length:     100 Hours (10 CEUs)
Tuition:      Call for pricing
Included:   Study materials/CD/DVD
Requisite:  Windows literacy
Summary:  Computer Forensics Examiner Basic and Advanced together at twice the normal pace (4 hours a day, Monday through Thursday). Dates must be coordinated well in advance.

Computer forensics is a relatively new professional endeavor within the computer science field. Little more than three decades old, it has garnered increasing attention in recent years due to an unusually high earning potential that tends to be almost immune from interstate, let alone overseas, competition. Computer forensics is the process of acquiring computer based information for use in legal proceedings or formal debate through a detailed or careful search. Legal proceedings normally refer to criminal or civil court trials, which are local in nature and therefore more effectively served by local examiners. Computer forensics, which was initially restricted to law enforcement officers, has more recently been practiced by those without law enforcement training. As such, it is increasingly popular among other computer professionals whose job prospects have been adversely affected by global competition.

Once you’ve decided you’re ready to embark on a career in computer forensics, enroll in our 6-week Basic or Advanced Examiner live online courses through the University of Texas at Arlington (UTA). Press the Home key above to find university contact and enrollment information in the upper right hand corner of the index page. Classes occur from Monday through Thursday. Evening classes occur from 6:00 p.m. to 8:00 p.m.; all times are US Central. Since Linux is employed to safely and effectively analyze Mac OS systems, possession of a Mac computer system is not needed.

Established in 1998, CompuForensics has long been popular among law enforcement, government intelligence and corporate security professionals. Previously restricted to full-time government employees or a select group of corporate security investigators, this high quality computer forensics training is now available to the general American public through nationally renowned and regionally accredited state universities and colleges. Those successfully completing at least 80% of scheduled Basic and Advanced classes, including a comprehensive forensics case study, are rewarded with a certificate signed by a dean or comparable official. Although designed as a 10.0 CEU (Continuing Education Units) university course with Pass/Fail grading, a university proctored written examination may be available for those requiring a letter grade. Course graduates can also elect to have their contact and training information listed on the Analysis page of this website.

US and Canadian students can attend live lecture sessions via a land line or cellular telephone when unable to more fully participate. Telephone conference connections are initiated by the instructor via Skype.

The screen to the left depicts our new Flash & HTML 5 video interface. Videos are embedded within the Power Point presentation. The green title button would be selected for Flash. The yellow HTML 5 button would be selected for HTML 5. This screen capture was made from a 2014 version of Firefox, which is HTML 5 compatible; web code has been augmented for additional Firefox compatibility. Older browsers are often not HTML 5 compatible and the continued Flash compatibility tends to fill the gap until HTML comes of age. The addition of HTML 5 compatibility improves support for Apple and late Android tablets and phones.

The 50-hour 6-week Basic Examiner course is intended for those new to computer forensics, but capable of loading and operating Windows. This introductory course provides an inexpensive vehicle to not only prepare for more advanced and challenging technical training, but also to better assess your aptitude for an increasingly competitive and demanding computer forensics career. This introduction to computer forensics includes Windows forensic hardware (workstation, notebook & write blocks), software (i.e., WinHex, FTK and other discrete utilities) as well as onsite searches, evidence collection and storage, and Internet investigations.

Completion of the Advanced Examiner course provides the technical training necessary to begin doing computer forensics. Unlike lesser courses teaching use of a single largely automated forensics program, students learn to understand and effectively use manual and discrete Windows and Linux utilities to expertly analyze computers running Windows and Mac OSX.

 The DEFT Live DVD is the primary, albeit not exclusive, Linux forensic analysis platform. DEFT Live provides an excellent collection of forensic capture and analysis utilities for search site and off-site analysis. Lectures and laboratories provide a substantial background in locating and recovering hidden and encrypted data. A realistic week long forensics criminal case exercise tests your comprehension of lessons learned during the Basic and Advanced course. Using a suite of Linux office software, students learn to create professional technical reports of investigation and court exhibits. The last week prepares you to defend your findings in court based upon an understanding of legal and procedural precedents as well as validated expert testimony techniques. A web cam is recommended for use during the last day of class.

To accommodate our government or corporate customers, accelerated onsite variations of our Basic and Advanced Examiner courses are available. The onsite 100-hour combined course can be provided at the UTA campus or the customer's facility 7-8 hours a day over a 2-3 week period. Ultimate pricing is affected by both the location and number of students. An accelerated online combined 100-hour course can also be provided 4-hours a day for 6-weeks. Pricing is again affected by the number of students.

The university scheduled live online Examiner courses are restricted to no more than nine students. Classes often tend to be smaller still, affording an unparalleled student-teacher ratio. Although scripted exercises are designed for independent use, the instructor is available should the student require immediate assistance during scheduled laboratory exercises.

Our Basic and Advanced Examiner courses are designed to equip government and private investigators/analysts with the skills needed to safely locate and secure computer evidence at the search site as well as to conduct subsequent off-site analysis. Select Syllabus to download a detailed listing of instructional topics contained in the two 50-hour courses. Linux, the world's most powerful operating system, is employed to more safely and effectively analyze Windows systems, including Windows 3.x, 9.x, ME, 2000, XP, Vista, Windows 7 and 8. This technique, increasingly used in the forensics community, was pioneered by the Department of Defense in the late 1990s. Frequently asked questions and a sample video interface is available by selecting the Questions button at the top of this page. Prospective students are also invited to contact the instructor by telephone or email.

Analysis is taught using both Windows and Linux. The current DEFT 8.1 Live DVD precludes inadvertent modification of target computers at or away from the search site. The use of a hardware write block is routinely employed to preclude Windows and Windows based analytic tools from writing to target (evidentiary) media. Below wholesale discounts for forensic write blocks is available to enrolled students. For those preferring to use Linux almost exclusively away from the search site, Code Weaver's CrossOver for Linux allows many Windows applications and forensic tools to run inside a wide variation of Linux distributions. Knoppix 7.2 Live DVD is additionally used to acquaint students with Linux.

Online Forensics Instructor
The instructor possesses professional training and experience second to none. Possessing bachelor and masters university degrees, the instructor additionally attended special agent academies for the Department of the Treasury, US Customs Service, Naval Criminal Investigative Service and USAF Office of Special Investigations. Applicable technical training was principally hosted by the Treasury Department and Central Intelligence Agency. A former field grade intelligence officer with the USAF and US Army, he is a decorated Vietnam air combat veteran. Retiring at age 53 with a quarter century of federal law enforcement experience, he served as field agent, agent supervisor and headquarters staff, including service as a national program manager for computer forensics. In addition to well over a decade of US Government computer forensics experience, he has taught computer forensics since 1999 at nine regionally accredited universities or colleges in the Midwest and South. Press Biography for a one-page instructor resume.

Forensics Examiner Student Background
All students should be fluent in English. All lectures, laboratories and videos are provided solely in English. The online format especially does not lend itself well to those with hearing or sight disabilities. Twelve week examiner students should minimally have prior experience in loading the Microsoft Windows operating system and applications, copying/moving/linking files using Windows Explorer, and be familiar with the use of classic menu options. Those intending to enroll in the Advanced course without first attending the Basic course should have prior forensics training and/or experience in addition to computer literacy approaching that of A+. Call if you have questions about your background for either the Basic or Advanced courses. Admission to the Advanced course without successful completion of the Basic course is contingent upon the approval of the instructor. Prior experience with Linux is not required for the Advanced course.


12-Week Examiner Computer System Requirements
Audio Headset - Use of an ear phone with an integrated microphone is required to avoid background noise and echo effects. Suitable head phones with integrated microphones are widely available for as little as $20. Student microphones should be muted when not used for talking.

Audio/Video Computer - A laptop, desktop or tower computer running Skype is recommended. A Flash or HTML 5 supported tablet or comparable Smartphone should suffice during most lectures. The Flash presentation interface should be compatible with all major desktop and notebook browsers supporting Flash 10.1 or later.  This interface has been successfully tested with Windows, Apple OSX and Linux, including Android tablets using 2.3.4 to 4.1x; Android 4.2 and later tablets can be made capable of viewing Flash presentations within Firefox by downloading Flash Player  11.1 for Android 4.0 at the Adobe Flash archive website.

Video quality has been lowered on the tests to accommodate slower download speeds associated with some mobile devices. To test Flash compatibility, press Flash Test; if you can see the presentation and video, you're browser is Flash compatible. Advance through the test by mouse clicking on each page. The Puffin Flash Browser uses external servers to effect Flash compatibility on iOS and late Android devices. According to the browser documentation, Puffin uses an encrypted tunnel between your device and US servers, which reportedly does not permanently retain any personal information. Puffin is less than $2 per year at the Google Play Store. To test HTML 5 browser compatibility, press HTML 5 Test; if you can see the presentation and video, you are HTML 5 compatible. Again, mouse select pages to advanced within the test presentation.

Puffin browser for Android played both the Flash and HTML 5 test presentation and video without a problem on a Samsung Tab 2 and LG Android phone with Android 4.2+; Firefox for Android with Flash 11.1 installed played the Flash and HTML 5 presentation, however, played only the audio from the video in the Flash test on the same tablet and phone (Firefox was HTML 5 video compatible). Any late model Android or iOS device should be compatible with the HTML 5 presentation. A Microsoft Surface 2 tablet using Internet Explorer played both Flash and HTML 5 presentations/videos without a problem. Like Windows phones, the Surface 2 runs a non-PC processor with an accordingly modified version of Windows. Microsoft Surface Pro tablets contain Intel i3, i5 or i7 processors running 64bit Windows 8.1 Pro and have the same excellent compatibility as Windows desktops and notebooks.

Skype teleconferencing software is available for Windows, Macintosh, Linux and Android operating systems. Download a free copy of Skype from www.Skype.com. GoToMeeting may replace Skype in larger classes. Skype, owned by Microsoft and most likely more popular than all other VOIP alternatives combined, employs 256bit AES encryption.


Advanced Exercise Computer
- Since the Advanced Examiner course involves some rebooting during online laboratory sessions, simultaneous use of a separate forensic exercise computer is recommended. The exercise computer should be minimally equipped with a DVD-ROM bootable drive. The exercise computer should minimally be configured with a Pentium IV or equivalent processor running at 1.6 GHz or faster, 2 gigabytes of RAM (Random Access Memory) and 30 gigabytes of free hard disk capacity. Use of RAID or unusually large drives is not recommended. While the exercise computer can be a notebook, use of a desktop or tower with at least one available removable drive bay is preferred for those intending to use their exercise computer to do computer forensics analysis at the conclusion of the course. The exercise computer should contain Windows XP, Windows Vista or Windows 7. DEFT 8 Linux will be installed during the initial weeks of the Advanced course. Instruction on how to install OpenSuSE Linux, the most popular business distribution, is available, however, most Linux forensics analysis will be accomplished using DEFT 8.1 Linux. Code Weavers Crossover can be used to run Windows applications under many Linux distributions.

Use of a virtual exercise computer on the Audio/Video Computer in lieu of a separate exercise computer is authorized with the understanding that support for virtual operating environments is limited to the VMware freeware Player. VMware Workstation and Player, as well as Oracle Virtual Box, have been used successfully by students in recent courses.

Exercise Software - Required Basic and Advanced preliminary and Advanced comprehensive forensic exercise raw images are available in Norton Ghost, SafeBack 3.0, WinHex and Active Disk Image formats. If used, Norton Ghost should be 2001, 2002 or 2003; Ghost 10 is the last version to include Ghost 2003. Possession of a personal or higher licensed version of WinHex disk editor is recommended for the Basic course; the specialist or higher license is recommended for those intending to do forensics after completion of the Advanced course. A personal license copy (about $50 US) will support most WinHex instruction requirements. The trial ware version of WinHex can be used with the understanding that several of the Basic course WinHex exercises will not be supported. Password protected advanced course video support websites contain ISO images of Open SuSE 11.1, Knoppix 5.1.1, Knoppix 7.2 and the CompuForensics CDROM. Exercise images, smaller ISO images and VMware virtual machine software will be available to basic and advanced students via a student DropBox.

Basic students are issued a CompuForensics bootable CD-ROM. DEFT DVD and 512MB flash drive (exercise image installed) by mail along with evidence bag and tape samples. Advanced students not attending the Basic are issued the CompuForensics bootable CDROM, DEFT DVD, 512MB flash drive (exercise image installed) along with evidence bag and tape samples by mail. Only one attempt is made to deliver mailed items to most foreign countries.

DEFT 8.1, an Italian forensics implementation based on Ubuntu, is the primary forensics platform employed. In the graphic below, a Mac OSX exercise partition has been mounted in Read-only mode. Various Linux forensics utilities are then employed to effectively analyze and document the partition.


Scheduled CompuForensics Online Computer Forensics Courses

Mon thru Thu
Mar. 16 - Apr. 27
2015

50-hr. 6-week Forensics Basic Examiner live online
M-Th, 6 - 8 p.m. Central Time
Observed holiday: None
Enrollment Open
5
CEUs
$449

Mon thru Thu
Jun. 1 - Jul. 13 2015

50-hr. 6-week Forensics Adv. Examiner live online
M-Th, 6 - 8 p.m. Central Time
Observed holiday: Independence Day
Enrollment Open
5
CEUs
$499 (599 w/o Basic)

© CompuForensics     Home  Syllabus  Analysis  Links     Rev. October 28, 2014