fr
en
Lead Forensics Examiner: Digital Forensic Investigation
After an incident, investigation quality determines how well the facts are understood. Structure the collection and analysis of digital traces while preserving their integrity. Develop a rigorous approach to substantiate your conclusions and support incident response.
- Duration
- 4.5 days 31 hours
- Code
- CLFE Code
- Certification
- PECB Certified Lead Forensics Examiner Certification
Accredited training for the PECB Certified Lead Forensics Examiner certification.
Presentation
Digital forensics comprises methods and techniques for identifying and collecting digital evidence from a network or computing device at the request of a judicial authority. The Lead Forensics Examiner leads or supervises investigation procedures within an organisation's computer network.
The Lead Forensics Examiner course teaches you to understand and master digital forensic activities in a judicial context, using best practices for handling and protecting evidence. You will also understand computer forensics fundamentals, evidence recovery processes and analytical techniques. The programme focuses on the core skills required to collect and analyse data from operating systems including Windows, Mac OS X, Linux, Android and iOS.
After completing the course, you will be ready to take the Lead Forensics Examiner exam. Depending on your experience, this can lead to one of 3 PECB designations, including Certified Provisional Forensics Examiner, which requires no professional experience. Certification demonstrates that you have the skills to conduct forensic analysis, write reports and collect evidence for advanced forensic investigations.
Objectives
By the end of the Lead Forensics Examiner course, you will be able to:
- Understand computer investigation challenges and the Lead Computer Forensics Examiner's responsibilities.
- Identify common objectives, standards and methodologies for examining electronic media.
- Understand the correct sequence of steps in digital forensic and computer incident investigations.
- Identify open-source and commonly used tools for incident investigations and digital forensic operations.
- Develop the skills to plan and conduct computer forensic operations.
- Implement and maintain a security network that protects evidence.
- Pass the PECB Certified Lead Computer Forensics Examiner exam and obtain certification.
The course also offers benefits applicable to organisations of any size in information security, including:
- Stronger security management and improved incident responsiveness.
- The ability to understand and trace incident origins and user involvement.
- Competitive advantage.
- Compliance with applicable laws and regulations.
Program
Day 1: Introduction to computer forensics and incident management
- ISO 27037:2012.
- Scientific and legal approaches to computer forensics.
- Incident response and computer forensic operation fundamentals.
- Practices promoted by the DoJ and NIST.
- Computer forensic laboratory requirements.
Day 2: Preparing and overseeing a computer forensic investigation
- What is a digital forensic investigation?
- Computer crime investigation processes.
- Common operating systems and file systems.
- Mobile devices.
- Maintaining the chain of custody: policies and procedures.
Day 3: Analysing and managing digital artefacts
- Open-source and commercial tools.
- Digital artefacts: identification, acquisition, analysis and communication.
- Best practices for using computer forensic tools.
- Stages of digital incident simulations.
Days 4 & 5: Case study and simulation exercises
- Understand emerging threats.
- Present digital forensic findings.
- Present evidence in court.
Final half-day
- Take the certification exam for Lead Computer Forensics Examiner (duration: 3 hours).
Please note: PECB Lead Computer Forensics Examiner course materials are available in English only.
Audience
This course is intended for:
- Computer forensic specialists and consultants.
- Cybersecurity experts seeking deeper computer forensic knowledge.
- Cyber intelligence analysts.
- Digital evidence recovery specialists.
- IT professionals seeking to understand judicial processes relating to cybercrime.
Prerequisites
The course in Lead Forensics Examiner has the following prerequisite:
- Sound computer forensic knowledge is strongly recommended.
Teaching and assessment methods
- Initial skills assessment
- Training materials provided to participants
- Continuous assessment throughout the course
- End-of-course feedback questionnaire
- Combination of theory and practical application
- Attendance records
- Post-course follow-up evaluation
- Practical exercises
- Case study
Course highlights
Practical exercises based on real cases, with 450 pages of documentation; 31 CPD credits; PECB certification exam included in the course price; if you do not pass, retake it free of charge within 12 months.
Dates and sessions
Choose the date and delivery format that suit you.
No upcoming sessions are currently available.
