Computer forensics is the recovery of digital data for use as evidence in both civil and criminal legal proceedings, or in internal investigations documenting violations of computer usage policies in public agency settings. This type of evidence is important in cases of white collar crime and espionage or theft, as well as in cases of harassment, embezzlement and con­spiracy. Laws of evidence must be known and followed to collect, preserve, analyze and present digital data in court. These laws also apply to organizations when they are documenting computer usage violations by employees.

In this course you will find that computer Forensics is a profession that differs significantly from the image portrayed on television. The reality is that you, the computer forensics expert needs much more experience than a solid background in IT. In this course you will first learn the "Big Picture" of civil litigation, the basics of criminal law and what can and cannot be ascertained through forensics analysis as well as IT knowledge and skills. You will then examine the law as it applies to Computer Forensics, Computer Forensics Tools and Computer Forensic Processes. You will study and use tools and processes utilized for effective information gathering in the field and in the lab. At the completion of the course, you will use case studies to apply what you previously learned in the course.

Note: Due to the nature of this course the participant cancel date for this class will be September 8, 2009.

Performance Objectives: Upon completion of this course you should be able to:

• Understand Law and Digital Forensics to include:
  • Evidentiary issues, Discovery and Chains of evidence.
  • Records management.
  • Preservation and petrification.
  • Spoliation.
  • Dealing with attorneys,
  • Conducting interviews.
  • Litigation.
  • Criminal/civil/internal investigation.
  • Depositions/expert reporting/testimony in court.

• Examine Computer Forensics Tools and Processes to include:
  • Crime scene evaluation
  • Hardware/hard disk structure/operating systems file management
  • Operating system limitations/imaging techniques
  • Forensic software
  • Encryption, passwords, and data hiding
  • Financial and text documents, Internet and e-mail examinations
  • Presenting the evidence

• Apply Computer Forensics using Case Studies to include:
  • Problems solving/systems analysis/investigation planning .
  • Digital evidence from an enterprise.
  • Network forensics.
  • Examine suspect profiling techniques.
  • Computer forensics lab management.
  • Quality assurance and quality control.
  • Case projects/analysis/presentation.

Competencies covered in this class: Security

Intended Audience:Public sector employees who supervise or perform IT forensic duties.

Pre-requisites: To enter the program you must demonstrate baseline technical competency in understanding and working with computers. Listed below are the acceptance criteria for the program.

• Applicants should have two years of college and two years of experience in the information technology field. Individuals with less than two years of experience may be accepted if they have completed relevant education or training programs.
• Applicants who do not meet the recommended admissions requirements may be reviewed on a case-by-case basis and interviewed by the UWT Director of Continuing Studies and designee and/or the instructor for the program to determine acceptance status.

Application Processes: The application process is simple:

• Notify your Senior IT Manager of your interest and obtain approval/support.
• Have your Training Manager register you in the HRDIS training registration system.
• Submit a resume outlining you education and job experience to Walt Jones or Priscilla Martinez via mail or email to the individuals shown below.
• Receive your letter of acceptance from UW Tacoma

Contact Information: