Introduction to Digital Forensics: Gathering and Preserving Electronic Evidence
 | CPE Credit: 16
Course Level: Basic
Prerequisite: None
| The proliferation of technology in the modern-day workplace presents a world of opportunity for fraudsters – and a complex challenge for fraud investigators and examiners. Desktops, laptops, smartphones, digital cameras, even watches and GPS devices can all be used to abet a fraud. They also all leave behind a digital trail.
Gathering and preserving electronic evidence requires a special set of considerations. Without a thorough understanding of digital forensics, your next move could compromise evidence or cause your findings to be inadmissible in court.
This two-day instructor-led course will introduce you to the essential knowledge you need when your investigation turns up electronic evidence. Learn best practices for evidence collection, chain of custody, expert designation and analysis. You’ll also take an in-depth look at the role of a digital forensics expert and how to effectively work with one. Upcoming Courses Columbia, SC | September 11-12, 2014 You Will Learn How To: Properly handle digital evidence Apply methods and legal implications of seizing digital evidence Identify types of crimes involving digital media Categorize types and characteristics of digital storage devices Perform techniques used to seize, secure and analyze digital evidence Understand the forensic examiners role and the dos and don’ts of handling digital evidence Recognize digital artifacts and the methodology for imaging digital evidence
Who Should Attend: Attorneys, legal professionals and law enforcement personnel Detectives and private investigators IT professionals Internal auditors, forensic accountants and bank examiners Certified Fraud Examiners and other anti-fraud professionals Fees Members: $795
Non-Members: $945 CPE Credit
16 Field of Study
Computer Science Course Level
Basic Prerequisite
None
Advanced Preparation None Delivery Method Group-Live
| | Day One | | 7:30-8:00 a.m. | Registration & Continental Breakfast | | 8:00-9:20 a.m. | Computer Forensics and Fraud Investigations In this session, you will get an overview of how computer forensics has evolved to become a critical component of many fraud examinations. In addition, you will hear about some real-world, high-tech fraud investigations. | | 9:20-9:35 a.m. | Break | | 9:35-10:55 a.m. | Computer Forensic Examination Process This section will discuss how the forensic examination is planned, the phases of the examination, and when and how to call in the experts. This section presents an overview of the entire process, including: pre-deployment, securing and preserving evidence, analysis, production, reporting and preparing for declarations/depositions. | | 10:55-11:10 a.m. | Break | | 11:10 a.m.-12:30 p.m. | Principles of Computer Forensics This section covers the basic elements you will need to be familiar with during your digital forensic investigation. Terminology and equipment are introduced, along with the fundamentals for gathering and reviewing evidence, and some essential considerations for reporting and producing exhibits. | | 12:30-1:30 p.m. | Group Lunch | | 1:30-2:50 p.m. | Digital Documents, Correspondence and Communication Knowing, as specifically as you can, the type of documents for which you are searching is a key component to any digital forensics examination. What is expected to be found in those documents is also crucial. A hardcopy of a document or email may not be as valuable as the original stored on the computer. In this session, learn about metadata and the other hidden attributes of computer documents, even those that may have been deleted. This session also begins the practical problem/case study that will run for the rest of the seminar. | | 2:50-3:05 p.m. | Break | | 3:05-4:25 p.m. | Evidence Seizure and Security This section introduces digital search and seizure following Industry Best Practices. It includes corporate and law-enforcement considerations as well as overt vs. covert methods. This session will cover such topics as: evidence collection and storage, chain of custody considerations, seizing vs. imaging, tools traditionally used and why, media types (removable vs. installed), storing and handling digital evidence, and how to prevent or mitigate spoliation. | | | Day Two | | 7:30-8:00 a.m. | Continental Breakfast | | 8:00-9:20 a.m. | Working with the Digital Forensic Examiner: Understanding What They Are Doing If the case requires a computer forensic expert you, as the lead investigator, will need to know where to locate such an expert and how they will go about their work, what tools they might use, and how these tools will get you what you need. | | 9:20-9:35 a.m. | Break | | 9:35-10:55 a.m. | Working with the Digital Forensic Examiner: Understanding How They Are Doing It This session will review how the digital forensic examiner identifies and secures all potential sources of electronic evidence and what tools and techniques they use in their work. | | 10:55-11:10 a.m. | Break | | 11:10 a.m.-12:30 p.m. | Asking the Right Questions To Get What You Need, Part 1 As the lead investigator you will need to know how to ask the computer forensic expert the right questions in the right way to optimize their work and enable them to be productive in the pursuit of your case. To do this, you need to know your case and where it might lead. You also need to be aware of, and prepared for, the unexpected. Computer forensics work may result in discovery of more than you bargained for, and the fraud examiner needs to know what to do and how to approach each new finding in both the fraud at hand, and the unexpected findings of the examination. | | 12:30-1:30 p.m. | Group Lunch | | 1:30-2:50 p.m. | Asking the Right Questions To Get What You Need, Part 2 Building on the earlier block, this session continues to develop the expertise to work with the computer forensic expert; teaching you how to answer their questions as well as ask your own. Technical expertise is not a requirement, but knowledge of how these experts work and how to optimize your requests is key. | | 2:50-3:05 p.m. | Break | | 3:05-4:25 p.m. | Putting it all Together: Preparing Your Case for the Next Step The outcome of your case can rest on the quality of the work done and who performed the work. Courts need assurance that evidence was obtained and handled in the most appropriate manner possible. This wrap-up session will bring your case to a close and prepare you for the next steps in your fraud examination. | Event Cancellation Policy Our cancellation policy is intended to keep costs low for attendees. Due to financial obligations incurred by ACFE, Inc. you must cancel your registration prior to the start of the event. Cancellations received less than 14 calendar days prior to an event start date are subject to a $100 administrative fee. No refunds or credits will be given for cancellations received on or after the start date of the event. Those who do not cancel and do not attend are responsible for the full registration fee. Satisfaction Guarantee ACFE seminars are unmatched in scope and effectiveness and backed by our unconditional satisfaction guarantee. If you attend an ACFE event and are not completely satisfied, please contact an ACFE Member Services Representative at MemberServices@ACFE.com or call (800) 245-3321 / +1 (512) 478-9000.  The Association of Certified Fraud Examiners, Inc. is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website: www.learningmarket.org
If you would like to begin receiving email notifications from the ACFE, please click here to subscribe.
|
|