This introductory, hands-on intensive course is intended for military and law enforcement digital forensic investigators, digital forensic response team members, analysts, and those performing missions and activities that have the potential to require seizing and collecting information and/or evidence from digital media.

This class is designed to answer and address the mission requirements of the following groups:

1. Military: This course provides digital forensics knowledge, awareness and skills that directly enhance and contribute to mission accomplishment.
   • Benefits the attack team that captures the military target (to ensure they don’t inadvertently damage or destroy digital information).
   • BPrepares military digital forensic response team members so they can quickly identify, collect and exploit digital forensic information and intelligence.
   • BTrains and prepares military analysts to understand how to approach, analyze and exploit captured information.
2. Law Enforcement: This course provides digital forensics knowledge, awareness and skills that directly enhance and contribute to mission accomplishment.
   • Benefits law enforcement officers on take down and arrest teams (to ensure they don’t inadvertently damage or destroy digital evidence and information).
   • Prepares law enforcement digital forensic response team members so they can quickly identify, collect and exploit digital forensic evidence and information.
   • Trains and prepares law enforcement investigators and analysts to understand and analyze and the collected evidence.

Note: This course is beneficial to individuals with no prior digital forensics training or skills and individuals who although they may have some self-taught forensic skills have never attended a thorough forensics fundamentals training course (this course will add to their knowledge and fill in the gaps).

The course provides a basic understanding of how computers work and how they recognize, manage and store data. It will also define Cyber data and cyber crime. Students will learn physical device concepts, the boot process of a computer, and hard drive numbering and password protected systems.

In addition, this course will explain computer file systems and computer operating systems and their role in the forensic investigation; the Logical versus Physical Partitions; the format process; detailed information regarding saving files and directories (including a detailed overview of directory entries). Additionally, the concepts of sectors, clusters file slack and unallocated space will be covered, as well as the affects of deleting files and the forensic issues surrounding their recovery.

Students will learn how to identify where data is stored and how to seize data from computer systems, hand-held systems, cell phones, networked environments, RAID systems, e-mail servers, database servers, the Internet, CDs, DVDs, and other digital storage systems or devices. In addition, students will learn the importance of the digital forensic laboratory and how to setup, run, and maintain a digital forensic laboratory.

Every module of this training course includes the academic knowledge and hands-on experience necessary to produce competent and proficient digital forensic investigators and practitioners.

The following digital forensic systems and equipment will be introduced and used during the hands-on portions of this course:

• Forensic Imaging Software
• Handheld Field Unit Imaging Device
• CD-DVD Imaging System
• Cell Phone Acquisition and Imaging System
• Write-Blocking Devices
• Portable Forensic Workstation
• Forensic Reporting Tool
• CD-DVD Reporting Tool
• Cell Phone Reporting Tool

Each H-11 Digital Forensics course includes a Hands-on Practical Exam to help the student’s retention of skills learned and to reinforce the knowledge attained during the training period.