The following descriptions describe the various courses that will be offered by the TVRCFL.

---

Social Media & Open Source Intelligence

This course covers the skills investigators need to conduct successful online investigations involving social media.

Secure Techniques for Onsite Previewing

This course covers the usage and configuration of two tools (Paladin/Autopsy and osTriage) designed to preview a non-mobile digital device and export files of evidentiary value.

Best Practices Collection and Seizure of Mobile Devices for Investigators

This training will help the Investigator / First Responder to identify mobile device digital evidence and associated media, and take precautions to preserve the evidence. It also provides information related to the specialized and extensive analysis that may be conducted by forensic personnel in order to review data contained on the evidence. Finally, they will obtain a clear understanding of the required documentation and the potential for testimony related to the seizure of any Digital Evidence.

Seizing and Handling of Digital Evidence

Investigators learn how to collect and preserve digital evidence, and to integrate digital evidence into a case. Additionally, investigators are exposed to the advanced tools and techniques used by the TVRCFL, so they can better understand what to expect from a forensics examination. This course requires no prerequisites, but attendees should have a working knowledge of computers.

Image Scan Training

The FBI's Computer Analysis Response Team (CART) developed the Image Scan system to help investigators locate the presence of picture files that may contain contraband on a computer. This system allows the investigator to view a variety of graphic formats during a consensual search, and protects valuable digital evidence by booting up a computer using the Linux operating system. After mounting the hard drive in a “read only” manner, Image Scan prompts the investigator to search for picture files only. During this process, the tool logs every step taken by the investigator, further documenting what occurred during the search process.

Law enforcement personnel that conduct on-site investigations for child pornography are encouraged to take the Image Scan training.

Cell Phone Investigative Kiosk Training

Cell phones can contain crucial evidence in your case. Ever wish you could process these devices yourself? You can! Learn how to use the TVRCFL's self-service Cell Phone Kiosk in this 3-hour class. At the end of the class, you will be able to extract data from a cell phone, put it into a report, and burn the report to a CD or DVD in as little as 30 minutes.

Loose Media Investigative Kiosk Training

Loose media like thumb drives, digital camera media cards, and suspect CDs can contain crucial evidence in your case. Ever wish you could process these yourself? You can! Learn how to use the TVRCFL's self-service Loose Media Kiosk in this 3-hour class. At the end of the class, you will be able to extract data from loose media, put it into a report, and burn the report to a CD or DVD.

Case Agent Investigative Review (for FTK6)

FTK is one of the tools that the TVRCFL uses in computer forensic examinations. We believe that the case investigator is the most knowledgeable person to conduct an analysis of digital media to determine its relevance to an investigation. For example, who better to determine that a particular e-mail between two individuals is relevant?

This course provides students with the knowledge and skills necessary to effectively use FTK to conduct a comprehensive review of digital media that has been submitted to and processed by the TVRCFL. This includes techniques to locate and examine e-mail messages, deleted files, documents, graphic files, as well as searching for key words and phrases.