Computer Forensics Training

CompuForensics for Computer Forensics Training

US and Canadian students can attend live lecture sessions via a land line or cellular telephone when unable to more fully participate. Telephone conference connections are initiated by the instructor via Skype.

The screen to the left depicts our new Flash & HTML 5 video interface. Videos are embedded within the Power Point presentation. The green title button would be selected for Flash. The yellow HTML 5 button would be selected for HTML 5. This screen capture was made from a 2014 version of Firefox, which is HTML 5 compatible; web code has been augmented for additional Firefox compatibility. Older browsers are often not HTML 5 compatible and the continued Flash compatibility tends to fill the gap until HTML comes of age. The addition of HTML 5 compatibility improves support for Apple and late Android tablets and phones.

The 50-hour 6-week Basic Examiner course is intended for those new to computer forensics, but capable of loading and operating Windows. This introductory course provides an inexpensive vehicle to not only prepare for more advanced and challenging technical training, but also to better assess your aptitude for an increasingly competitive and demanding computer forensics career. This introduction to computer forensics includes Windows forensic hardware (workstation, notebook & write blocks), software (i.e., WinHex, FTK and other discrete utilities) as well as onsite searches, evidence collection and storage, and Internet investigations.

Completion of the Advanced Examiner course provides the technical training necessary to begin doing computer forensics. Unlike lesser courses teaching use of a single largely automated forensics program, students learn to understand and effectively use manual and discrete Windows and Linux utilities to expertly analyze computers running Windows and Mac OSX.

The DEFT DVD is one of the Linux forensic analysis platforms used in the course. DEFT provides an excellent collection of forensic capture and analysis utilities for search site and off-site analysis. It offers the ability to mount FAT and NTFS drives in Read Only as well as Read Write mode. Being able to mount drives reliably in Read Only mode at the search site is particularly essential at the search site where the number of systems to be searched precludes use of hardware write blocks. For XP or earlier generation computers, Knoppix 5.1.1 serves the same end.

Lectures and laboratories provide a substantial background in locating and recovering hidden and encrypted data. A realistic week long forensics criminal case exercise tests your comprehension of lessons learned during the Basic and Advanced courses. Using a suite of Linux office software, students learn to create professional technical reports of investigation and court exhibits. The last week prepares you to defend your findings in court based upon an understanding of legal and procedural precedents as well as validated expert testimony techniques. A web cam is recommended for use during the last day of class.

The university scheduled live online Examiner courses are restricted to fewer students than classroom courses due to the online laboratory format. Classes often tend to be smaller still, affording an unparalleled student-teacher ratio. Although scripted exercises are designed for independent use, the instructor is available should the student require immediate assistance during scheduled laboratory exercises.

Our Basic and Advanced Examiner courses are designed to equip government and private investigators/analysts with the skills needed to safely locate and secure computer evidence at the search site as well as to conduct subsequent off-site analysis. Select

to download a detailed listing of instructional topics contained in the two 50-hour courses. Linux, the world's most powerful operating system, is employed to more safely and effectively analyze Windows systems, including Windows 3.x, 9.x, ME, 2000, XP, Vista, Windows 7, 8 and 10. This technique, increasingly used in the forensics community, was pioneered by the Department of Defense in the late 1990s. Frequently asked questions and a sample video interface is available by selecting the Questions button at the top of this page. Prospective students are also invited to contact the instructor by telephone or email.

Analysis is taught using both Windows and Linux. OpenSuSE is pictured below with a freeware directory tree program that is arguably without equal in any operating environment at any cost. This is one of several programs in which Linux provides a demonstrably superior forensic utility over discrete and automated Windows forensics. DEFT precludes inadvertent modification of target computers both at and away from the search site in addition to an easy to use graphical forensic disk imaging utility. The use of a hardware write block is still recommended to preclude Windows and Linux based analytic tools from inadvertently writing to target (evidentiary) media. At or below wholesale discounts for forensic write blocks are available to our enrolled students. For those preferring to use Linux almost exclusively away from the search site, Code Weaver's CrossOver for Linux allows many Windows applications and forensic tools to run inside a wide variation of Linux distributions. Knoppix is additionally used to acquaint students with Linux.

Online Forensics Instructor

The instructor possesses professional training and experience second to none. Possessing bachelor and masters university degrees, the instructor additionally attended special agent academies for the Department of the Treasury, US Customs Service, Naval Criminal Investigative Service and USAF Office of Special Investigations. Applicable technical training was principally hosted by the Treasury Department and Central Intelligence Agency. A former field grade intelligence officer with the USAF and US Army, he is a decorated Vietnam air combat veteran. Retiring at age 53 with a quarter century of federal law enforcement experience, he served as field agent, agent supervisor and headquarters staff, including service as a national program manager for computer forensics. In addition to well over a decade of US Government computer forensics experience, he has taught computer forensics since 1999 at nine regionally accredited universities or colleges in the Midwest and South. Press

for a one-page instructor resume.

Forensics Examiner Student Background
All students should be fluent in English. All lectures, laboratories and videos are provided solely in English. The online format especially does not lend itself well to those with hearing or sight disabilities. Twelve week examiner students should minimally have prior experience in loading the Microsoft Windows operating system and applications, copying/moving/linking files using Windows Explorer, and be familiar with the use of classic menu options. Those intending to enroll in the Advanced course without first attending the Basic course should have prior forensics training and/or experience in addition to computer literacy approaching that of A+. Call if you have questions about your background for either the Basic or Advanced courses. Admission to the Advanced course without successful completion of the Basic course is contingent upon the approval of the instructor. Prior experience with Linux is not required for the Advanced course.

12-Week Examiner Computer System Requirements

Audio Headset -Use of an ear phone with an integrated microphone is required to avoid background noise and echo effects. Suitable head phones with integrated microphones are widely available for as little as $20. Student microphones should be muted when not used for talking.

Audio/Video Computer - A laptop, desktop or tower computer running Skype is recommended. A Flash or HTML 5 supported tablet or comparable Smartphone should suffice during most lectures. The Flash presentation interface should be compatible with all major desktop and notebook browsers supporting Flash 10.1 or later. This interface has been successfully tested with Windows, Apple OSX and Linux, including Android tablets using 2.3.4 to 4.1x; Android 4.2 and later tablets can be made capable of viewing Flash presentations within Firefox by downloading Flash Player 11.1 for Android 4.0 at the Adobe Flash archive website.

Video quality has been lowered on the tests to accommodate slower download speeds associated with some mobile devices. To test Flash compatibility, press

; if you can see the presentation and video, you're browser is Flash compatible. Advance through the test by mouse clicking on each page. The Puffin Flash Browser uses external servers to effect Flash compatibility on iOS and late Android devices. According to the browser documentation, Puffin uses an encrypted tunnel between your device and US servers, which reportedly does not permanently retain any personal information. Puffin is less than $2 per year at the Google Play Store. To test HTML 5 browser compatibility, press

; if you can see the presentation and video, you are HTML 5 compatible. Again, mouse select pages to advanced within the test presentation.

In 2018, Microsoft replaced the familiar Skype Version 7.4 with a new version (8.x), which is not only different but at times difficult to use for group calls. If you have the same experience that I have with the new Skype, you may want to download Skype 7.4 using this hot link. Unfortunately, Microsoft will continue to ask you to upgrade and you will have to be careful not to. An earlier version of Skype allowed the user not to check for a newer version.

Puffin browser for Android played both the Flash and HTML 5 test presentation and video without a problem on a Samsung Tab 2 and Android phone with Android 4.2+; Firefox for Android with Flash 11.1 installed played the Flash and HTML 5 presentation, however, played only the audio from the video in the Flash test on the same tablet and phone (Firefox was HTML 5 video compatible). Any late model Android or iOS device should be compatible with the HTML 5 presentation. A Microsoft Surface 2 tablet using Internet Explorer played both Flash and HTML 5 presentations/videos without a problem. Like Windows phones, the Surface 2 runs a non-PC processor with an accordingly modified version of Windows. Microsoft Surface Pro tablets contain Intel i3, i5 or i7 processors running 64bit Windows 8.1 Pro and have the same excellent compatibility as Windows desktops and notebooks.

Skype teleconferencing software is available for Windows, Macintosh, Linux and Android operating systems. Download a free copy of Skype from www.Skype.com. Skype for Business is not supported. GoToMeeting may replace Skype in larger classes. Skype, owned by Microsoft and most likely more popular than all other VOIP alternatives combined, employs 256bit AES encryption.

Advanced Exercise Computer - Since the Advanced Examiner course involves some rebooting during online laboratory sessions, simultaneous use of a separate forensic exercise computer is recommended. The exercise computer should be minimally equipped with a DVD-ROM bootable drive. The exercise computer should minimally be configured with a Pentium IV or equivalent processor running at 1.6 GHz or faster, 2 gigabytes of RAM (Random Access Memory) and 40 gigabytes of free hard disk capacity. Use of RAID or unusually large drives is not recommended. While the exercise computer can be a notebook, use of a desktop or tower with at least one available removable drive bay is preferred for those intending to use their exercise computer to do computer forensics analysis at the conclusion of the course. The exercise computer should contain Windows Vista or Windows 7; Windows 10 is currently a work in progress and should ultimately be compatible. DEFT Linux will be installed during the second week of the Advanced course, along with OpenSuSE 11.1. Linux forensics analysis is accomplished using Windows and three Linux distributions: DEFT; SuSE; and Knoppix. Code Weavers Crossover will be used to run Windows applications under SuSE.

Use of a virtual exercise computer on the Audio/Video Computer in lieu of a separate exercise computer is authorized with the understanding that support for virtual operating environments is limited to the VMware freeware Player. VMware Workstation and Player, as well as Oracle Virtual Box, have been used successfully by students in recent courses.

Exercise Software - Required Basic and Advanced preliminary and Advanced comprehensive forensic exercise raw images are available in Norton Ghost, SafeBack 3.0, WinHex and Active Disk Image formats. If used, Norton Ghost should be 2001, 2002 or 2003; Ghost 10 is the last version to include Ghost 2003. Possession of a personal or higher licensed version of WinHex disk editor is recommended for the Basic course; the specialist or higher license is recommended for those intending to do forensics after completion of the Advanced course. A personal license copy (about $50 US) will support most WinHex instruction requirements. The trial ware version of WinHex can be used with the understanding that several of the Basic course WinHex exercises will not be supported. Password protected advanced course video support websites contain ISO images of Open SuSE 11.1, Knoppix 5.1.1, and the CompuForensics CDROM. Exercise images and VMware/Virtual Box virtual machine software will be available to basic and advanced students via a student DropBox.

Students are provided a CompuForensics bootable CD-ROM and flash drive exercise image by DropBox. Students will need to purchase an inexpensive 512MB flash drive for use with the exercise image.

DEFT, an Italian forensics implementation based on Ubuntu, is one of four forensics platforms employed in the Advanced course, the others being Windows, SuSE and Knoppix. In the graphic below, a Mac OSX exercise partition has been mounted in Read-only mode by DEFT. DEFT utilizes various forensics utilities to effectively analyze and document the partition. Skilled manual forensic examiners should never limit themselves to a single utility or operating system, instead choosing the best tool for the job. Within Windows, several forensics analysis and imaging utilities are employed, foremost among which is XWays WinHex. WinHex, a German product written in English, is arguably the finest disk editor available at any cost anywhere in the world.

Computer forensics is a relatively new professional endeavor within the computer science field. Little more than three decades old, it has garnered increasing attention in recent years due to an unusually high earning potential that tends to be almost immune from interstate, let alone overseas, competition. Computer forensics is the process of acquiring computer based information for use in legal proceedings or formal debate through a detailed or careful search. Legal proceedings normally refer to criminal or civil court trials, which are local in nature and therefore more effectively served by local examiners. Computer forensics, which was initially restricted to law enforcement officers, has more recently been practiced by those without law enforcement training. As such, it is increasingly popular among other computer professionals whose job prospects have been adversely affected by global competition.

Once you’ve decided you’re ready to embark on a career in computer forensics, enroll in our 6-week Basic or Advanced Examiner live online courses through the University of Texas at Arlington (UTA). Press the key above to find university contact and enrollment information in the upper right hand corner of the index page. Classes occur from Monday through Thursday. Evening classes occur from 6:30 p.m. to 8:30 p.m.; all times are US Central. Since Linux is employed to safely and effectively analyze Mac OS systems, possession of a Mac computer system is not needed.

Established in 1998, CompuForensics has long been popular among law enforcement, government intelligence and corporate security professionals. Previously restricted to full-time government employees or a select group of corporate security investigators, this high quality computer forensics training is now available to the general American public through nationally renowned and regionally accredited state universities and colleges. Those successfully completing at least 80% of scheduled Basic and Advanced classes, including a comprehensive forensics case study, are rewarded with a certificate signed by a dean or comparable official.Course graduates can also elect to have their contact and training information listed on the Analysis page of this website.