Seizing and Handling of Digital Evidence

Investigators learn how to collect and preserve digital evidence, and to integrate digital evidence into a case. Additionally, investigators are exposed to the advanced tools and techniques used by the RCFL, so they can better understand what to expect from a forensics examination. This course requires no prerequisites, but attendees should have a working knowledge of computers.

Image Scan Training

The FBI's Computer Analysis Response Team (CART) developed the Image Scan system to help investigators locate the presence of picture files that may contain contraband on a computer. This system allows the investigator to view a variety of graphic formats during a consensual search, and protects valuable digital evidence by booting up a computer using the Linux operating system. After mounting the hard drive in a “read only” manner, Image Scan prompts the investigator to search for picture files only. During this process, the tool logs every step taken by the investigator, further documenting what occurred during the search process.

Law enforcement personnel that conduct on-site investigations for child pornography are encouraged to take the Image Scan training.

Cell Phone Investigative Kiosk Training

Cell phones can contain crucial evidence in your case. Ever wish you could process these devices yourself? You can! Learn how to use the RCFL's self-service Cell Phone Kiosk in this 3-hour class. At the end of the class, you will be able to extract data from a cell phone, put it into a report, and burn the report to a CD or DVD in as little as 30 minutes.

Loose Media Investigative Kiosk Training

Loose media like thumb drives, digital camera media cards, and suspect CDs can contain crucial evidence in your case. Ever wish you could process these yourself? You can! Learn how to use the RCFL's self-service Loose Media Kiosk in this 3-hour class. At the end of the class, you will be able to extract data from loose media, put it into a report, and burn the report to a CD or DVD.

Case Agent Investigative Review (for FTK3)

FTK is one of the tools that the RCFL uses in computer forensic examinations. We believe that the case investigator is the most knowledgeable person to conduct an analysis of digital media to determine its relevance to an investigation. For example, who better to determine that a particular e-mail between two individuals is relevant?

This course provides students with the knowledge and skills necessary to effectively use FTK to conduct a comprehensive review of digital media that has been submitted to and processed by the RCFL. This includes techniques to locate and examine e-mail messages, deleted files, documents, graphic files, as well as searching for key words and phrases.