Obtaining, Managing and Searching Electronic Evidence

Digital Forensics, Electronic Evidence and Fraud Examination 

In this block you will learn about the history of computer forensics and how the profession developed. You will also learn the difference between e-discovery and digital forensics, how digital investigations have evolved over time, and how digital forensics practices can be used to investigate fraud. 

Principles of Digital Forensics and Electronic Evidence 

In this block you will learn how to set goals for computer forensics examiners and understand some basic concepts and terms. You will also learn best practices for when to apply digital forensic examination techniques to a case, and when to bring in an outside expert. 

The Digital Forensic Examination Process 

Fraud examiners should be familiar with the steps in the digital forensics examination process, even if they are not doing it themselves. The process begins with an assessment of the case to determine an investigative strategy and to identify the right people for the examination team. Planning properly and gathering the necessary information can improve the efficiency and effectiveness of the examination. 

BYOD and Mobile-Device Forensics 

Bring Your Own Device (BYOD) and Bring Your Own Network (BYON) trends are sweeping through workplaces. and fraud examiners need to be aware of the potential risks these pose in relation to fraud. In this session you will learn about the benefits and challenges that accompany BYOD and BYON. You will consider a sample scenario and address other BYOD and BYON questions and issues associated with mobile device forensics. 

Cloud Computing Issues 

Cloud computing continues to grow in popularity, but it also brings with it unique security risks and potential investigation issues. In this session you will learn about the benefits and drawbacks of using cloud storage, including compliance issues, litigation response and other investigative concerns for fraud examiners. 

Asking the Right Questions to Get the Necessary Information 

Even in a digital forensic examination, individuals are a priceless resource, and effective anti-fraud professionals must know how to ask computer forensic professionals the right questions. In this session, you will learn whom to engage in an examination to ensure that you receive all the relevant information and fewer false positives. 

Investigative Search Strategies  

Knowing what you are looking for is critical to a successful fraud examination. Gathering evidence in paper-based environment is much different than collecting potential evidence that is stored electronically; the investigative strategies differ radically. In this section you will explore approaches to analyzing potential evidence and obtaining information you need. 

Potential Results from a Digital Forensics Analysis 

What type of results can you expect from a digital forensics analysis? There are many different outcomes and information that can stem from an examination and advance a case. This session will help you sift through the various analyses, activities, files and artifacts you might find amass during a case. 

Darknets, Anonymous Networks and Virtual Currencies  

The Deep Web is quickly becoming as indispensable to investigators as search-engine operators. If you don't know what the Tor network is or how to investigate within the Deep Web, this session will get you up to speed. You will also learn about other emerging technologies and virtual alternative currencies, including Bitcoin.  

Practical Problems: Bringing It All Together  

In this interactive session you will discuss several practical problems with your fellow attendees to apply all the information you've learned over the last two days. These practical problems will solidify the lessons learned so you can return to work and implement your new skills and knowledge for future fraud examination.