Obtaining, Managing and Searching Electronic Evidence




CPE Credit: 16
Course Level: Intermediate
Prerequisite: Some familiarity with how electronic evidence is obtained and secured

Fraud examinations are constantly evolving, and technology is often the driving force behind these changes. In today's data-driven environment, the evidence obtained to investigate and eventually prosecute a fraud can come from numerous sources — many of which are now digital. Identifying where digital evidence might be stored and using specialized tools and techniques to preserve this data will require new expertise from both the digital forensics practitioner and the fraud examiner. 

This 2-day seminar will introduce you to digital forensics and discuss accepted techniques to identify, preserve and manage digital evidence. You will learn how to qualify and work with the digital forensics expert to effectively narrow the focus of large volumes of data and identify those elements that will best serve the case. Learning how to work with these professionals and how to plan an investigative strategy in the digital environment will maximize your chance for a successful fraud examination.

Upcoming Courses

Indianapolis, IN | December 12-13, 2016

Las Vegas, NV | April 27-28, 2017

You Will Learn How To:  

Identify digital forensics best practices as they apply to a fraud examination  

Obtain and secure the digital evidence you are looking for

Locate evidence you need in the cloud and on mobile devices

Who Should Attend:  

Attorneys, legal professionals and law enforcement personnel

Detectives and private investigators 

IT professionals 

Internal auditors, forensic accountants and bank examiners

Certified Fraud Examiners and other anti-fraud professionals 


Members: $695
Non-Members: $845 

*Pricing listed is for U.S. events. International event pricing may vary by location. Please view the individual event page for International pricing.

CPE Credit


Field of Study

Information Technology

Course Level

Some familiarity with how electronic evidence is obtained and secured 

Advanced Preparation 


Delivery Method 


  Day One  
7:30-8:00 a.m.   Registration & Continental Breakfast   
8:00-9:20 a.m. 

Digital Forensics, Electronic Evidence and Fraud Examination 

In this block you will learn about the history of computer forensics and how the profession developed. You will also learn the difference between e-discovery and digital forensics, how digital investigations have evolved over time, and how digital forensics practices can be used to investigate fraud. 

9:20-9:35 a.m.  Break 
9:35-10:55 a.m. 

Principles of Digital Forensics and Electronic Evidence 

In this block you will learn how to set goals for computer forensics examiners and understand some basic concepts and terms. You will also learn best practices for when to apply digital forensic examination techniques to a case, and when to bring in an outside expert. 

10:55-11:10 a.m.  Break  
11:10 a.m.-12:30 p.m. 

The Digital Forensic Examination Process 

Fraud examiners should be familiar with the steps in the digital forensics examination process, even if they are not doing it themselves. The process begins with an assessment of the case to determine an investigative strategy and to identify the right people for the examination team. Planning properly and gathering the necessary information can improve the efficiency and effectiveness of the examination. 

12:30-1:30 p.m.  Group Lunch  
1:30-2:50 p.m. 

BYOD and Mobile-Device Forensics 

Bring Your Own Device (BYOD) and Bring Your Own Network (BYON) trends are sweeping through workplaces. and fraud examiners need to be aware of the potential risks these pose in relation to fraud. In this session you will learn about the benefits and challenges that accompany BYOD and BYON. You will consider a sample scenario and address other BYOD and BYON questions and issues associated with mobile device forensics. 

2:50-3:05 p.m.  Break  
3:05-4:25 p.m.  

Cloud Computing Issues 

Cloud computing continues to grow in popularity, but it also brings with it unique security risks and potential investigation issues. In this session you will learn about the benefits and drawbacks of using cloud storage, including compliance issues, litigation response and other investigative concerns for fraud examiners. 


  Day Two 
7:30-8:00 a.m.   Continental Breakfast   
8:00-9:20 a.m. 

Asking the Right Questions to Get the Necessary Information 

Even in a digital forensic examination, individuals are a priceless resource, and effective anti-fraud professionals must know how to ask computer forensic professionals the right questions. In this session, you will learn whom to engage in an examination to ensure that you receive all the relevant information and fewer false positives. 

9:20-9:35 a.m.  Break  
9:35-10:55 a.m. 

Investigative Search Strategies  

Knowing what you are looking for is critical to a successful fraud examination. Gathering evidence in paper-based environment is much different than collecting potential evidence that is stored electronically; the investigative strategies differ radically. In this section you will explore approaches to analyzing potential evidence and obtaining information you need. 

10:55-11:10 a.m.  Break  
11:10 a.m.-12:30 p.m. 

Potential Results from a Digital Forensics Analysis 

What type of results can you expect from a digital forensics analysis? There are many different outcomes and information that can stem from an examination and advance a case. This session will help you sift through the various analyses, activities, files and artifacts you might find amass during a case. 

12:30-1:30 p.m.  Lunch on Own 
1:30-2:50 p.m. 

Darknets, Anonymous Networks and Virtual Currencies  

The Deep Web is quickly becoming as indispensable to investigators as search-engine operators. If you don't know what the Tor network is or how to investigate within the Deep Web, this session will get you up to speed. You will also learn about other emerging technologies and virtual alternative currencies, including Bitcoin.  

2:50-3:05 p.m.  Break  
3:05-4:25 p.m.  

Practical Problems: Bringing It All Together  

In this interactive session you will discuss several practical problems with your fellow attendees to apply all the information you've learned over the last two days. These practical problems will solidify the lessons learned so you can return to work and implement your new skills and knowledge for future fraud examination. 

Event Cancellation Policy 

Our cancellation policy is intended to keep costs low for attendees. Due to financial obligations incurred by ACFE, Inc. you must cancel your registration prior to the start of the event. Cancellations received less than 14 calendar days prior to an event start date are subject to a $100 administrative fee. No refunds or credits will be given for cancellations received on or after the start date of the event. Those who do not cancel and do not attend are responsible for the full registration fee.

Satisfaction Guarantee 

ACFE seminars are unmatched in scope and effectiveness and backed by our unconditional satisfaction guarantee. If you attend an ACFE event and are not completely satisfied, please contact an ACFE Member Services Representative at MemberServices@ACFE.com or call (800) 245-3321 / +1 (512) 478-9000.

NASBA CPEThe Association of Certified Fraud Examiners, Inc. is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website: www.nasbaregistry.org

If you would like to begin receiving email notifications from the ACFE, please click here to subscribe.