Introduction to Digital Forensics: Gathering and Preserving Electronic Evidence
 |
CPE Credits: 16
Course Level: Basic
Prerequisite: None
|
The proliferation of technology in the modern-day workplace presents a world of opportunity for fraudsters – and a complex challenge for fraud investigators and examiners. Desktops, laptops, smartphones, digital cameras, even watches and GPS devices can all be used to abet a fraud. They also all leave behind a digital trail.
Gathering and preserving electronic evidence requires a special set of considerations. Without a thorough understanding of digital forensics, your next move could compromise evidence or cause your findings to be inadmissible in court.
This two-day instructor-led course will introduce you to the essential knowledge you need when your investigation turns up electronic evidence. Learn best practices for evidence collection, chain of custody, expert designation and analysis. You’ll also take an in-depth look at the role of a digital forensics expert and how to effectively work with one.
Upcoming Courses
Columbia, SC | September 11-12, 2014
You Will Learn How To:
Properly handle digital evidence
Apply methods and legal implications of seizing digital evidence
Identify types of crimes involving digital media
Categorize types and characteristics of digital storage devices
Perform techniques used to seize, secure and analyze digital evidence
Understand the forensic examiners role and the dos and don’ts of handling digital evidence
Recognize digital artifacts and the methodology for imaging digital evidence
Who Should Attend:
Attorneys, legal professionals and law enforcement personnel
Detectives and private investigators
IT professionals
Internal auditors, forensic accountants and bank examiners
Certified Fraud Examiners and other anti-fraud professionals
Fees
ACFE Members: $795
Non-Members: $945
CPE Credit
16
Field of Study
Computer Science
Course Level
Basic
Prerequisite
None
Advanced Preparation
None
Delivery Method
Group-Live
| |
Day One |
| 7:30-8:00 a.m. |
Registration & Continental Breakfast |
| 8:00-9:20 a.m. |
Computer Forensics and Fraud Investigations
In this session, you will get an overview of how computer forensics has evolved to become a critical component of many fraud examinations. In addition, you will hear about some real-world, high-tech fraud investigations.
|
| 9:20-9:35 a.m. |
Break |
| 9:35-10:55 a.m. |
Computer Forensic Examination Process
This section will discuss how the forensic examination is planned, the phases of the examination, and when and how to call in the experts. This section presents an overview of the entire process, including: pre-deployment, securing and preserving evidence, analysis, production, reporting and preparing for declarations/depositions.
|
| 10:55-11:10 a.m. |
Break |
| 11:10 a.m.-12:30 p.m. |
Principles of Computer Forensics
This section covers the basic elements you will need to be familiar with during your digital forensic investigation. Terminology and equipment are introduced, along with the fundamentals for gathering and reviewing evidence, and some essential considerations for reporting and producing exhibits.
|
| 12:30-1:30 p.m. |
Group Lunch |
| 1:30-2:50 p.m. |
Digital Documents, Correspondence and Communication
Knowing, as specifically as you can, the type of documents for which you are searching is a key component to any digital forensics examination. What is expected to be found in those documents is also crucial. A hardcopy of a document or email may not be as valuable as the original stored on the computer. In this session, learn about metadata and the other hidden attributes of computer documents, even those that may have been deleted. This session also begins the practical problem/case study that will run for the rest of the seminar.
|
| 2:50-3:05 p.m. |
Break |
| 3:05-4:25 p.m. |
Evidence Seizure and Security
This section introduces digital search and seizure following Industry Best Practices. It includes corporate and law-enforcement considerations as well as overt vs. covert methods. This session will cover such topics as: evidence collection and storage, chain of custody considerations, seizing vs. imaging, tools traditionally used and why, media types (removable vs. installed), storing and handling digital evidence, and how to prevent or mitigate spoliation.
|
| |
Day Two |
| 7:30-8:00 a.m. |
Continental Breakfast |
| 8:00-9:20 a.m. |
Working with the Digital Forensic Examiner: Understanding What They Are Doing
If the case requires a computer forensic expert you, as the lead investigator, will need to know where to locate such an expert and how they will go about their work, what tools they might use, and how these tools will get you what you need.
|
| 9:20-9:35 a.m. |
Break |
| 9:35-10:55 a.m. |
Working with the Digital Forensic Examiner: Understanding How They Are Doing It
This session will review how the digital forensic examiner identifies and secures all potential sources of electronic evidence and what tools and techniques they use in their work.
|
| 10:55-11:10 a.m. |
Break |
| 11:10 a.m.-12:30 p.m. |
Asking the Right Questions To Get What You Need, Part 1
As the lead investigator you will need to know how to ask the computer forensic expert the right questions in the right way to optimize their work and enable them to be productive in the pursuit of your case. To do this, you need to know your case and where it might lead. You also need to be aware of, and prepared for, the unexpected. Computer forensics work may result in discovery of more than you bargained for, and the fraud examiner needs to know what to do and how to approach each new finding in both the fraud at hand, and the unexpected findings of the examination.
|
| 12:30-1:30 p.m. |
Group Lunch |
| 1:30-2:50 p.m. |
Asking the Right Questions To Get What You Need, Part 2
Building on the earlier block, this session continues to develop the expertise to work with the computer forensic expert; teaching you how to answer their questions as well as ask your own. Technical expertise is not a requirement, but knowledge of how these experts work and how to optimize your requests is key.
|
| 2:50-3:05 p.m. |
Break |
| 3:05-4:25 p.m. |
Putting it all Together: Preparing Your Case for the Next Step
The outcome of your case can rest on the quality of the work done and who performed the work. Courts need assurance that evidence was obtained and handled in the most appropriate manner possible. This wrap-up session will bring your case to a close and prepare you for the next steps in your fraud examination.
|
Event Cancellation Policy
Our cancellation policy is intended to keep costs low for attendees. Due to financial obligations incurred by ACFE, Inc. you must cancel your registration prior to the start of the event. Cancellations received less than 14 calendar days prior to an event start date are subject to a $100 administrative fee. No refunds or credits will be given for cancellations received on or after the start date of the event. Those who do not cancel and do not attend are responsible for the full registration fee.
Satisfaction Guarantee
ACFE seminars are unmatched in scope and effectiveness and backed by our unconditional satisfaction guarantee. If you attend an ACFE event and are not completely satisfied, please contact an ACFE Member Services Representative at MemberServices@ACFE.com or call (800) 245-3321 / +1 (512) 478-9000.
 The Association of Certified Fraud Examiners, Inc. is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website: www.learningmarket.org
If you would like to begin receiving email notifications from the ACFE, please click here to subscribe.
|
|