HARTMANN software group

CDFE: Certified Digital Forensics Examiner Training in Tustin

Enroll in or hire us to teach our CDFE: Certified Digital Forensics Examiner class in Tustin, California by calling us @303.377.6176. Like all HSG classes, CDFE: Certified Digital Forensics Examiner may be offered either onsite or via instructor led virtual training. Consider looking at our public training schedule to see if it is scheduled: Public Training Classes
Provided there are enough attendees, CDFE: Certified Digital Forensics Examiner may be taught at one of our local training facilities.
We offer private customized training for groups of 3 or more attendees.
get pricing information

Course Description

  
Digital Forensics is the investigation and recovery of data contained in digital devices. This data is often the subject of investigations in litigation, proof of guilt, and corrective action in an organization. When the time comes that you need to investigate your organization, will you have the skill set necessary to gather the digital data that you need? The Certified Digital Forensics Examiner course will benefit organizations, individuals, government offices, and law enforcement agencies in performing these investigations and reporting their findings.
Course Length: 5 Days
Course Tuition: $2690 (US)

Prerequisites
C)SS: Security Sentinel C)ISSO: Information Systems Security Officer Or equivalent experience

Course Outline

  

Module 1 – Introduction

  • Lesson Objectives
  • Introductions (Instructor)
  • Introductions (Students)
  • Disclaimers
  • Notice
  • Course Schedule
  • Student Guide (Layout)
  • Introduction to Computer Forensics
  • Course Objectives

Module 2 – Computer Forensic Incidents

  • Lesson Objectives
  • The Legal System
  • Criminal Incidents
  • Civil Incidents
  • Computer Fraud
  • Internal Threats
  • Investigative Challenges
  • Common Frame of Reference
  • Media Volume

Module 3 – Investigation Process

  • Lesson Objectives
  • Investigating Computer Crimes
  • Prior to the Investigation
  • Forensics Workstation
  • Building Your Team of Investigators
  • Preparing for an Investigation
  • Search Warrant
  • Forensic Photography
  • Preliminary Information
  • First Responder
  • Collecting Physical Evidence
  • Collecting Electronic Evidence
  • Guideline for Acquiring Electronic Evidence
  • Securing the Evidence
  • Managing the Evidence
  • Chain of Custody
  • Duplicate the Data
  • Verify the Integrity of the Image
  • Who is involved in Computer Forensics?
  • Decision Makers and Authorization
  • Risk Assessment
  • Forensic Investigation Toolkit
  • Investigation Methodology
  • Recover Last Data
  • Data Analysis
  • Data Analysis Tools
  • Assessing the Evidence
  • Assessing the Case
  • Location Assessment
  • Best Practices
  • Documentation
  • Gathering and Organizing Information
  • Writing the Report
  • Expert Witness
  • Closing the Case

Module 4 – OS Disk Storage Concepts

  • Lesson Objectives
  • Disk Based Operating Systems
  • OS / File Storage Concepts
  • Disk Storage Concepts 

Module 5 – Digital Acquisition and Analysis

  • Lesson Objectives
  • Digital Acquisition
  • Digital Acquisition Procedures
  • Digital Forensic Analysis Tools 

Module 6 – Forensic Examination Protocols

  • Lesson Objectives
  • Forensic Examination Protocols
  • Forensic Examination 

Module 7 – Digital Evidence Protocols

  • Lesson Objectives
  • Digital Evidence Concepts
  • Digital Evidence Categories
  • Digital Evidence: Admissibility

Module 8 – Computer Forensic Investigative

  • Theory
  • Lesson Objectives
  • Computer Forensic Investigative Theory

Module 9 – Digital Evidence Presentation

  • Lesson Objectives
  • Digital Evidence Presentation
  • Digital Evidence
  • Digital Evidence: Hearsay
  • Digital Evidence: Summary

Module 10 – Computer Forensics Lab

  • Protocols
  • Lesson Objectives
  • Overview
  • Reports
  • Peer Review
  • Who should review?
  • Peer Review
  • Consistency
  • Accuracy
  • Research
  • Validation
  • Quality Assurance
  • Standard Operating Procedures
  • Relevance
  • Peer Review
  • Annual Review
  • Deviation
  • Lab Intake
  • Tracking
  • Storage
  • Discovery

Module 11 – Computer Forensics Processing

  • Techniques
  • Lesson Objectives
  • Computer Forensic Processing Techniques

Module 12 – Digital Forensics Reporting

  • Lesson Objectives
  • Analysis Report
  • Definition
  • Computer Sciences
  • Ten Laws of Good Report Writing
  • Request
  • Summary of Findings
  • Forensic Examination
  • Tools
  • Evidence
  • Cover Page
  • Table of Contents
  • Examination Report
  • Background
  • Items of Evidence
  • Analysis
  • Findings
  • Conclusion
  • Exhibits
  • Signatures

Module 13 – Specialized Artifact Recovery

  • Lesson Objectives
  • Prep System Stage
  • Lesson Objectives
  • Background
  • Overview
  • Prep System Stage
  • Windows File Date/Time Stamps
  • File Signatures
  • Image File Databases
  • The Windows OS
  • Windows Registry
  • Alternate Data Streams
  • Windows Unique ID Numbers
  • Decode GUID’s
  • Historical Files
  • Windows Recycle Bin
  • Copy out INFO2 for Analysis
  • Web E-mail

Module 14 – eDiscovery and ESI

  • Lesson Objectives
  • eDiscovery
  • Discoverable ESI Material
  • eDiscovery Notification
  • Required Disclosure
  • eDiscovery Conference
  • Preserving Information
  • eDiscovery Liaison
  • eDiscovery Products
  • Metadata
  • What is Metadata?
  • Data Retention Architecture
  • “Safe Harbor” Rule 37(f)
  • eDiscovery Spoliation
  • Tools for eDiscovery

Module 15 – Cell Phone Forensics

  • Lesson Objectives
  • Cell Phones
  • Types of Cell Networks
  • What can a criminal do with Cell Phones?
  • Cell Phone Forensics
  • Forensics Information in Cell Phones
  • Subscriber Identity Module (SIM)
  • Integrated Circuit Card Identification (ICCID)
  • International Mobile Equipment Identifier (IMEI)
  • Electronic Seal Number (ESN)
  • Helpful Hints for the Investigation
  • Things to Remember when Collecting Evidence
  • Acquire Data from SIM Cards
  • SIM Cards
  • Cell Phone Memory
  • Analyze Information
  • Analyze
  • Cell Phone Forensic Tools
  • Device and SIM Card Seizure
  • Cell Phone Analyzer
  • Tools
  • Forensic Card Reader
  • ForensicSIM Tool
  • Forensic Challenges
  • Paraben Forensics Hardware
  • Paraben: Remote Charger
  • Paraben: Device Seizure Toolbox
  • Paraben: Wireless Stronghold Tent
  • Paraben: Passport Stronghold Bag
  • Paraben: Project-a-phone
  • Paraben: SATA Adapter
  • Paraben: Lockdown
  • Paraben: SIM Card Reader
  • Paraben: Sony Clie
  • Paraben: CSI Stick
  • Paraben: USB Serial DB9 Adapter
  • Paraben: P2 Commander

Module 16 – USB Forensics

  • Lesson Objectives
  • USB Components
  • USB Forensics
  • USB Forensics Investigation
  • Determine USB Device Connected
  • Tools for USB Imaging

Module 17 – Incident Handling

  • Lesson Objectives
  • Incident Handling Defined
  • What is a security event?
  • Common Security Events of Interest
  • What is a security incident?
  • What is an incident response plan?
  • When does the plan get initiated?
  • Common Goals of Incident Response Management
  • Incident Handling Steps
  • Goal
  • Be Prepared
  • The Incident Response Plan
  • Incident Handling
  • Incident Response Plan
  • Roles of the Incident Response Team
  • Incident Response Team Makeup
  • Challenges of building an IRT
  • Incident Response Training and Awareness
  • Jump Kit
  • Restore System(s) to Operation
  • Goal
  • Report Findings
  • Restore System
  • Verify

Appendix 1 – PDA Forensics

  • Lesson Objectives
  • Personal Digital Assistants
  • Characteristics
  • Palm OS
  • Palm OS Architecture
  • Pocket PC
  • Windows Mobile Architecture
  • Linux-based PDAs
  • Linux OS for PDAs-Architecture
  • Typical PDA State
  • Security Issues
  • ActiveSync and HotSync
  • PDA Forensic Steps
  • Tips for Conducting the Investigation
  • PDA Forensic Tools
  • Countermeasures

Appendix 2- Investigating Harassment

  • Lesson Objectives
  • Sexual Harassment Overview
  • Examples of Sexual Harassment
  • What it is not?
  • Approach of General Investigation
  • Conduct Your Investigation
  • Preventative Action

Labs 1-4 Objective Summary

  • Recovering electronically stored data for civil litigation
  • Recovering, categorizing and analyzing data
  • Hiding and discovering potential evidence
  • Investigating a misappropriations of proprietary information complaints
  • Bit-by-bit imaging digital media and preserving the integrity of the image
  • Identifying and reconstructing information within various file systems
  • Conducting an investigation into a complaint of sexual harassment
  • Understanding anti-forensics and steganography
  • Discover how a computer has been used and learn:
  • What websites have been visited?
  • What data has been deleted, and why?
  • What data is stored on the hard drive?
  • What e-mails have been sent and received?
  • Has data been copied off of the computer?

Lab 1 – Preparing Forensic Workstations

  • AccessData FTK Imager Installation
  • AccessData FTK Installation
  • KFF Library Database Installation
  • AccessData Registry Viewer Installation
  • AccessData Password Recovery Toolkit
  • Installation

Lab 2 – Chain of Custody

  • Chain of Custody Search and Seizure
  • Chain of Custody Forensic Imaging

Lab 3 – Imaging Case Evidence / FTK Imager

Lab 4 – Reviewing Evidence / AccessData Tools

  • Creating a Case in AccessData Forensic Toolkit
  • Review Evidence in AccessData FTK Imager
  • Review Software File in AccessData Registry View
  • Review System File in AccessData Registry Viewer
  • Review SAM File in AccessData Registry Viewer

Course Directory [training on all levels]

Technical Training Courses
Software engineer/architect, System Admin ... Welcome!
Business Training Courses
Project Managers, Business Analysts, Paralegals ... Welcome!
Upcoming Classes
Gain insight and ideas from students with different perspectives and experiences.

Interesting Reads Take a class with us and receive a book of your choosing for 50% off MSRP.