• Classroom
Course Description

In Part 2 of this series on the introduction to cyber forensics, we examined several topics which form the basis for our understanding of how data eventually become digital evidence, including a review of volume versus partition, cylinder, head, sector, and Logical Block Addressing, File Systems, FAT 12/16 and NTFS, the File Allocation Table (FAT), Master File Table (MFT) and took a quick look at several alternative filing systems.

In Part 3 we continue the cyber forensic investigation process with an examination of the critical role that time plays in an investigation along with the presentation of forensic investigative smart practices. These smart practices represent the recommended step-by-step processes, for cyber forensic investigators desiring to maximize the potential for a successful cyber forensics investigation/assessment.

Learning Objectives

After completing this course, participants will be able to:

  • Describe both the role and significance that time contributes, to cyber forensic investigations.
  • Explain the foundations of forensic time
  • Communicate the importance of time and date to the cyber forensic process
  • Analyze the process for determining correct date and time associated with forensic evidence under review
  • Comprehend the cyber forensic investigative process, enabling better management of ongoing and subsequent cyber forensic analyses.

Framework Connections

The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):

Specialty Areas

  • Digital Forensics