Together, Reducing Fraud Worldwide

  • introduction to digital forensics 

     

     
    DAY ONE 
    DAY TWO 
    7:30 a.m. - 8:00 a.m.   Registration - Breakfast Pastries  Breakfast Pastries 
    8:00 a.m. - 9:20 a.m. 

    Computer Forensics and Fraud Investigations  

    In this session, you will get an overview of how computer forensics has evolved to become a critical component of many fraud examinations. In addition, you will hear about some real-world, high-tech fraud investigations.

    Working with the Digital Forensic Examiner: Understanding What They Are Doing 

    If the case requires a computer forensic expert you, as the lead investigator, will need to know where to locate such an expert and how they will go about their work, what tools they might use, and how these tools will get you what you need.

    9:20 a.m. - 9:35 a.m.  Break  Break 
    9:35 a.m. - 10:55 a.m. 

    Computer Forensic Examination Process 

    This section will discuss how the forensic examination is planned, the phases of the examination, and when and how to call in the experts. This section presents an overview of the entire process, including: pre-deployment, securing and preserving evidence, analysis, production, reporting and preparing for declarations/depositions.  

    Working with the Digital Forensic Examiner: Understanding How They Are Doing It 

    This session will review how the digital forensic examiner identifies and secures all potential sources of electronic evidence and what tools and techniques they use in their work.

     

    10:55 a.m. - 11:10 a.m.  Break  Break 
    11:10 a.m. - 12:30 p.m. 

    Principles of Computer Forensics 

    This section covers the basic elements you will need to be familiar with during your digital forensic investigation. Terminology and equipment are introduced, along with the fundamentals for gathering and reviewing evidence, and some essential considerations for reporting and producing exhibits.

     

    Asking the Right Questions To Get What You Need, Part 1 

    As the lead investigator you will need to know how to ask the computer forensic expert the right questions in the right way to optimize their work and enable them to be productive in the pursuit of your case. To do this, you need to know your case and where it might lead. You also need to be aware of, and prepared for, the unexpected. Computer forensics work may result in discovery of more than you bargained for, and the fraud examiner needs to know what to do and how to approach each new finding in both the fraud at hand, and the unexpected findings of the examination. 

    12:30 p.m. - 1:30 p.m.  Group Lunch  Lunch on Your Own 
    1:30 p.m. - 2:50 p.m. 

    Digital Documents, Correspondence and Communication 

    Knowing, as specifically as you can, the type of documents for which you are searching is a key component to any digital forensics examination. What is expected to be found in those documents is also crucial. A hardcopy of a document or email may not be as valuable as the original stored on the computer. In this session, learn about metadata and the other hidden attributes of computer documents, even those that may have been deleted. This session also begins the practical problem/case study that will run for the rest of the seminar.

    Asking the Right Questions To Get What You Need, Part 2 

    Building on the earlier block, this session continues to develop the expertise to work with the computer forensic expert; teaching you how to answer their questions as well as ask your own. Technical expertise is not a requirement, but knowledge of how these experts work and how to optimize your requests is key.

    2:50 p.m. - 3:05 p.m.  Break  Break 
    3:05 p.m. - 4:25 p.m.  

    Evidence Seizure and Security 

    This section introduces digital search and seizure following Industry Best Practices. It includes corporate and law-enforcement considerations as well as overt vs. covert methods. This session will cover such topics as: evidence collection and storage, chain of custody considerations, seizing vs. imaging, tools traditionally used and why, media types (removable vs. installed), storing and handling digital evidence, and how to prevent or mitigate spoliation.

    Putting it all Together: Preparing Your Case for the Next Step 

    The outcome of your case can rest on the quality of the work done and who performed the work. Courts need assurance that evidence was obtained and handled in the most appropriate manner possible. This wrap-up session will bring your case to a close and prepare you for the next steps in your fraud examination.

     

     

    Event Details