Advanced Forensic Computing

Course structure A one week course with a substantial amount of practical sessions in a dedicated forensic computing lab. The sessions will be taught by a variety of lecturing staff with both academic and practitioner based backgrounds.
What you will learn On successful completion of this course those attending should be able to:

• Construct an overall digital forensic workflow that satisfies the requirements of evidential admissibility
• Construct, justify, and carry out a forensically sound process for disk imaging
• Conduct detailed manual forensic reconstruction of stored data (e.g. disk partition, file system, operating system, and application structures) including artefacts that may be unreadable by standard forensic tools
• Given a set of instructions for a case, construct an examination strategy to recover admissible digital evidence, and given a disk image, carry out that strategy to locate and extract digital evidence
• Produce appropriate documentation to accompany a digital forensic examination, including notes, statements and reports.