SYLLABUS. DIGITAL FORENSICS WITH EnCase 7 FORENSICS. Module 1: Basic course Module 2: Automation using EnScript Module 3: Advanced course

Transcription

1 SYLLABUS DIGITAL FORENSICS WITH EnCase 7 FORENSICS Module 1: Basic course Module 2: Automation using EnScript Module 3: Advanced course Approved by the Principal of the Norwegian Police University College 13 November 2014

2 1. Introduction Investigation of digital forensics is extremely complex and requires the use of different types of tools to solve various cases. Cyber investigators today use various main tools to secure, handle and analyse data seizures, among these being EnCase 7 Forensics. The use of such tools places high demands on the investigator with regard to legal safeguards and efficiency. In order to place the use of this tool into a policing framework, the Norwegian Police University College is offering a course of Further Education consisting of three modules: Module 1: EnCase 7 Basic course Module 2: EnCase 7 Automatisation using EnScript Module 3: EnCase 7 Advanced course 2. Target group and admission requirements 2.1. Target group The main target group is police staff in the Nordic countries and employees in Nordic public authorities/inspectorates with which the police cooperate Admission requirements Applicants must be employed in the public sector. In addition, applicants need to have fulfilled the following conditions in order to apply for the individual modules Module 1: EnCase 7 Basic course Applicants are required to: Document successful completion of NCFI module 1 and Either have commenced or successfully completed NCFI module 2 Or have completed relevant education in engineering Or document prior learning and work experience equivalent to NCFI module 2 Digital forensics with EnCase 7 forensics, module 1, 2 og Side 1

3 Module 2: EnCase 7 Automatisation using EnScript Applicants are required to Document successful completion of NCFI module 2 Or document prior learning and work experience equivalent to NCFI module 2 Or have completed relevant education in engineering Have completed module 1: EnCase 7 Basic course Have basic experience from one or more programming languages Module 3: EnCase 7 Advanced Course Applicants are required to Document successful completion of NCFI module 2 Or document prior learning and work experience equivalent to NCFI module 2 Or have completed relevant education in engineering Have completed module 1: EnCase 7 Basic course og module 2: Automatisation using EnScript 3. Module 1: EnCase 7 Basic course 3.1 Knowledge After completing the course students will have acquired Basic knowledge about the strengths and weaknesses of analytical tools 3.2 Skills After completing the course students will be able to install and configure analytical tools administer cases and secure units navigate in the tool s user interface use the tool rationally use various methods and techniques for securing use various techniques for processing the seizure generate reports Digital forensics with EnCase 7 forensics, module 1, 2 og Side 2

4 3.3 Organisation and study requirements The course consists of a one-week seminar of approximately 40 hours, including classroom teaching and practice tasks. Course attendance is obligatory. The study methods used shall provide students with a high learning outcome. Focus is placed on providing a variety of study methods incorporating a high level of student activity. 3.4 Assessment At the end of the course there is an individual written test. A certificate will be issued upon successful completion of the course. 3.5 Literature All material included in the course. Torben Strand, National Cyber Crime Center, Basic Education Module 1 - EnCase v7. 4. Module 2: EnCase 7 Automatisation using EnScript 4.1 Knowledge After completing the course students will have acquired thorough knowledge about: Strengths and weaknesses of EnScript automatisation in EnCase Skills After completing the course students will be able to use EnScript API (Application Programming Interface) implement, verify, troubleshoot and develop EnScript programming to improve work efficiency Digital forensics with EnCase 7 forensics, module 1, 2 og Side 3

5 4.3 Organisation and study requirements The course consists of a one-week seminar of approximately 40 hours, including classroom teaching and practice tasks. Course attendance is obligatory. The study methods used shall provide students with a high learning outcome. Focus is placed on providing a variety of study methods incorporating a high level of student activity. 4.4 Assessment At the end of the course there is an individual written test. A certificate will be issued upon successful completion of the course. 4.5 Literature All material included in the course. Computer Forensics and Digital Investigation with EnCase Forensic v7, Suzanne Widup, ISBN Chapter Module 3: EnCase 7 - Advanced 5.1 Knowledge After completing the course students will have acquired thorough knowledge about: strengths and weaknesses of EnCase Skills After completing the course students will be able to make templates and adjust them according to the type of case conduct advanced investigation of electronic storage media 5.3 Organisation and study requirements The course consists of a one-week seminar of approximately 40 hours, including classroom teaching and practice tasks. Course attendance is obligatory. The study methods used shall provide students with a high learning outcome. Focus is placed Digital forensics with EnCase 7 forensics, module 1, 2 og Side 4

6 on providing a variety of study methods incorporating a high level of student activity. 5.4 Assessment At the end of the course there is an individual written test. A certificate will be issued upon successful completion of the course. 5.5 Literature All material included in the course. Digital forensics with EnCase 7 forensics, module 1, 2 og Side 5