Forensic Tool Kit for Investigators (FTK)
FTK is one of several tools that the WNYRCFL uses while conducting digital forensics examinations. This course teaches investigators how to use FTK so they can conduct a comprehensive review of the digital media that has been submitted to, or processed by the WNYRCFL. This course also teaches investigators how to locate and examine e-mail messages, deleted files, documents, graphic files, and how to search for key words and phrases.
The FBI's Computer Analysis Response Team (CART) developed the ImageScan system to help investigators locate pictures that may contain contraband on a computer, while conducting consent searches in the field. Students that take this course receive the following—
An explanation of the technical background of the ImageScan system and its components, along with trouble-shooting suggestions.
ImageScan CD, ImageScan boot floppy disk (optional), and a USB device are provided to every student that successfully completes the course. Students should bring their government laptop/notebook computer and floppy drives to the class, however, systems containing "Watchdog" are not permissible. If these devices are not available to a student— the WNYRCFL will provide them the necessary equipment so they can complete the course.
Handouts pertaining to the presentation portion of the course, including several ImageScan Preview Checklist sheets.
Students should be assigned to a unit that conducts child exploitation or computer investigations.
Students should have an above-average degree of computer knowledge and be familiar with attaching devices, inserting media, navigating Windows, and how computers operate.
Law enforcement personnel that conduct on-site investigations for child pornography are encouraged to take the ImageScan training.
Seizing and Handling of Digital Evidence ("Bag and Tag")
This class covers the following topics—
- Recognizing digital evidence
- How to recognize different operating system
- How to shut down personal computers while preserving evidence
- When to call for help
- Who to call