Introduction to Digital Forensics: Gathering and Preserving Electronic Evidence

Computer Forensics and Fraud Investigations 

In this session, you will get an overview of how computer forensics has evolved to become a critical component of many fraud examinations. In addition, you will hear about some real-world, high-tech fraud investigations.

Computer Forensic Examination Process 

This section will discuss how the forensic examination is planned, the phases of the examination, and when and how to call in the experts. This section presents an overview of the entire process, including: pre-deployment, securing and preserving evidence, analysis, production, reporting and preparing for declarations/depositions.

Principles of Computer Forensics 

This section covers the basic elements you will need to be familiar with during your digital forensic investigation. Terminology and equipment are introduced, along with the fundamentals for gathering and reviewing evidence, and some essential considerations for reporting and producing exhibits.

Digital Documents, Correspondence and Communication 

Knowing, as specifically as you can, the type of documents for which you are searching is a key component to any digital forensics examination. What is expected to be found in those documents is also crucial. A hardcopy of a document or email may not be as valuable as the original stored on the computer. In this session, learn about metadata and the other hidden attributes of computer documents, even those that may have been deleted. This session also begins the practical problem/case study that will run for the rest of the seminar.

Evidence Seizure and Security  

This section introduces digital search and seizure following Industry Best Practices. It includes corporate and law-enforcement considerations as well as overt vs. covert methods. This session will cover such topics as: evidence collection and storage, chain of custody considerations, seizing vs. imaging, tools traditionally used and why, media types (removable vs. installed), storing and handling digital evidence, and how to prevent or mitigate spoliation.

Working with the Digital Forensic Examiner: Understanding What They Are Doing  

If the case requires a computer forensic expert you, as the lead investigator, will need to know where to locate such an expert and how they will go about their work, what tools they might use, and how these tools will get you what you need.

Working with the Digital Forensic Examiner: Understanding How They Are Doing It 

This session will review how the digital forensic examiner identifies and secures all potential sources of electronic evidence and what tools and techniques they use in their work.

Asking the Right Questions To Get What You Need, Part 1 

As the lead investigator you will need to know how to ask the computer forensic expert the right questions in the right way to optimize their work and enable them to be productive in the pursuit of your case. To do this, you need to know your case and where it might lead. You also need to be aware of, and prepared for, the unexpected. Computer forensics work may result in discovery of more than you bargained for, and the fraud examiner needs to know what to do and how to approach each new finding in both the fraud at hand, and the unexpected findings of the examination.

Asking the Right Questions To Get What You Need, Part 2 

Building on the earlier block, this session continues to develop the expertise to work with the computer forensic expert; teaching you how to answer their questions as well as ask your own. Technical expertise is not a requirement, but knowledge of how these experts work and how to optimize your requests is key.

Putting it all Together: Preparing Your Case for the Next Step 

The outcome of your case can rest on the quality of the work done and who performed the work. Courts need assurance that evidence was obtained and handled in the most appropriate manner possible. This wrap-up session will bring your case to a close and prepare you for the next steps in your fraud examination.