Course Code: GES305
Understand the needs of a computer forensic examiner. Learn how to deal with clients and employers, ethics required for the role, and opportunities in the job market.
Begin learning about recommended machine configurations, as well as imaging theory and processes. You’ll also learn how to identify files and data formats.
Master the FAT and NTFS filing systems. Learn how to process directories, deal with unallocated space, and create and delete files.
Continue the course by learning the fundamentals of registries and artifacts. You’ll examine logical structures, data recovery techniques, and basic internet issues, amongst other things.
Explore the use of policy and checklists in forensic practice. Develop an understanding of the legal process, case report writing, and going to court.
Complete the course by learning about the mobile phone extraction process including collection, isolation, interrogation, imaging, and analysis.
Module 1- Introduction to Computer Forensics
Module 2 – Imaging
Module 3 – File Signatures, Data Formats & Unallocated Space
Module 4 – FAT File System
Module 5 – NTFS File System
Module 6 – Registry & Artifacts
Module 7 – Forensic Policy, Case Writing, Legal Process & Forensic Tool Kits
Module 8 - Introduction to Mobile Data Exploitation
Bill Long is a retired law enforcement supervisor with the Oklahoma Office of the Inspector General. He is a CFCE and is owner and president of William J. Long & Associates LLC, a firm specializing in computer forensic examinations and data recovery.
John Fretts, in 2004, retired as a Senior Special Agent from the Bureau of Alcohol, Tobacco, Firearms and Explosives after 30 years. In addition to conducting firearms and explosives investigations he specialized in computer forensic investigations. John currently serves as Director of Investigations for a private firm in New England.
William D. "Bill" Taylor is a retired Computer Investigative Specialist/Special Agent with the US Treasury Inspector General for Tax Administration in Nashville, Tennessee. He holds both Baccalaureate and Master's Degrees in Criminal Justice and a Associates Degree in Forensic Computer Science. He is also a graduate of the 152nd Session of the FBI National Academy. Bill had over 35 years of investigative law enforcement experience when he retired.
Clifford "Cliff" Ellston was a Senior Special Agent from the Bureau of Alcohol, Tobacco, Firearms and Explosives after 35 years of service. In addition to conducting firearms and explosives investigations, he specialized in computer forensic investigations. Ellston currently serves as a compliance officer for a retail corporation. He also assists local police in their effort to handle and examine electronic media evidence.
To enroll in this course, you’ll need to have basic computer skills, including the ability to work outside the Windows GUI interface. This is because forensic examiners often need data that can’t easily be accessed from within Windows. Being comfortable working within the DOS environment will be very helpful in this field.
A good measure of your readiness for this course is knowing that you can successfully complete the A+ certification through CompTIA. Note that the certification is by no means a prerequisite. However, the basic knowledge needed for success in this course typically requires that you have the A+ level of experience.
A forensic computer examiner will be required to work with the hardware of a computer on many occasions, so you’ll need to have the ability or desire to remove and replace hard-disk drives from computers and change jumper settings. These topics are briefly covered within our course, but you should have these skills prior to enrolling.
To work in this field, you must not have a criminal record. This includes any felony conviction where the individual could have received a sentence of one or more years of imprisonment. This also includes any criminal history of sexually related offenses, as many digital examinations include these topics, and an examiner with this type of history could be easily discredited.
The instructional materials required for this course are included in enrollment and will be available online.
This course is based on the concept of teaching computer forensics from a vendor-neutral perspective, and you’ll learn the low-level mechanics of commonly encountered file systems. If you can gain a solid understanding of one file system and how it functions at a low level, then you’ll be prepared to learn other file systems as well.
This course material also teaches low-level mechanics and functions of both the FAT file system and the New Technology File System (NTFS). Although the FAT file system is not available on new computers, it’s the default file system on floppy diskettes and USB devices. Many computer forensic incidents involve USB devices and will continue to involve these devices for years to come. Consequently, students studying to become successful forensic computer examiners must understand the FAT file.
Windows 98 and earlier versions are based on the FAT file system. A computer formatted with Windows 2000, XP, and Vista versions will typically be formatted with the NTFS file system.
The completion of several practical exercises is a requirement of this course. Some might include floppy diskettes. Although the floppy diskette is no longer commonly encountered in the field, keep in mind that it’s the exercise that is significant, and any action taken on a floppy diskette can be replicated on a hard drive.
The International Society of Forensic Computer Examiners (ISFCE) is an independent, private certifying body that administers fair, unbiased examinations with high ethical standards. Its Certified Computer Examiner (CCE) credential is internationally recognized and well-known to employers and instructors in the computer forensics industry. Through the CCE certification, ISFCE wishes to advance the science and research in the industry and provide a level of professionalism. You can demonstrate your knowledge and your professionalism when you enroll in a course certified by ISFCE.
My facilitator Bill Taylor was first rate. He is a true subject matter expert with excellent customer service skills. He went above and beyond the call of duty to help resolve technical issues and answer all questions in a timely manner."
Yes, ed2go courses are online, so you never have to actually travel to the school. Most schools offer telephone or online registration.
This course is self-paced and open enrollment, so you can start when you want and finish at your own pace. When you register, you'll receive twelve (12) months to complete the course.
ed2go courses are non-credit, so they do not qualify for federal aid, FAFSA and Pell Grant. In some states, vocational rehab or workforce development boards will pay for qualified students to take our courses. Additionally, some students may qualify for financial assistance when they enroll, if they meet certain requirements. Financing is available from select schools. Learn more: https://www.ed2go.com/career/financial-assistance
Upon successful completion of the course, you will be awarded a certificate of completion. You will also become eligible to sit for the CCE Certification testing through the ISFCE. Note: You will need to list this training while submitting your application for the Certification.
This course will provide you with the skills you need to obtain an entry-level position in most cases. Potential students should always do research on the job market in their area before registering.
You may be assigned with an instructor or team of industry experts for one-on-one course interaction. Your support will be available (via e-mail) to answer any questions you may have and to provide feedback on your performance. All of our instructors are successful working professionals in the fields in which they teach. You will be assigned to an Advisor for academic support.
If you have questions that are not answered on our website, please feel free to contact us via LIVE CHAT or by calling us at (855) 520-6806. If you are visiting us during non-business hours, please feel free to send us a question using the Contact Us form.
This course is open enrollment, so you can register and start the course as soon as you are ready. Access to your course can take 24-48 business hours.
The time allotted for course completion has been calculated based on the number of course hours. However, if you are unable to complete the course, contact your Student Advisor to help you work out a suitable completion date. Please note that an extension fee may be charged.