Duration: 2 weeks Full Time
Examination: Written 2 hours, Practical 3 hours
Students acquire the knowledge, understanding and practical experience that will enable them to find and recover admissible digital evidence from PC based computers and the skills that will permit them competently to present such evidence in a Court of Law.
Topics Include: Electrical Safety, Exhibit handling and Continuity, ACPO Guidelines, Imaging and Reliability, Disk and Solid State systems, Manufacturers reserved areas , Disk Mapping, Data Storage Methods, Raid Construction, Computing Fundamentals, BIOS operation, use of DOS tools, Internals of FAT and NTFS (in great detail), Hidden Data, USB and other external devices, File Signatures and association, search catches and indexes, Registry examination, Passwords and Encryption, Recovery of date from an allocated space and methods to give it provenance, Forensic Computing Ethics.
Many of the above are subject to practical exercises and at least 6 disks will be analysed. The practical examination is based on the analysis of a complete hard disk.