Title: Understanding Computer Investigations
Course: CAP 2140 Digital Forensics > Section: Understanding Computer Investigations

While a basic computer user can solve most software problems by working with GUI, forensics professional needs to interact with primary levels of the OS. In this module students will work with forensic disk images from small USB drives to perform data search techniques, which then can be applied to a larger disk.

Objectives

At the end of this module the student will be able to:

- Explain how to prepare a computer investigation
- Apply a systematic approach to an investigation
- Describe procedures for corporate high-tech investigations
- Explain requirements for data recovery workstations and software
- Describe how to conduct an investigation
- Explain how to complete and critique a case

Readings and Resources

- Textbook: Chapter 2 pg. 27-60
- Sniffers: What They Are and How to Protect Yourself: http://www.symantec.com/connect/articles/sniffers-what-they-are-and-how-protect-yourself
- Forensic Examiner: http://www.computercop.com/forensicexaminer.html