Digital Forensics and Electronic Evidence

Course details

With the extremely fast pace of technology development, electronic evidence has become a potential part of nearly all court cases. For this reason, an understanding of Digital Forensics, also sometimes known as computer forensics, has become very important for anyone involved with legal matters.

During many years of forensics consulting, we have seen how difficult it is for legal professionals and other people faced with legal action to gain an understanding of the principals of electronic evidence, especially when there is limited time available. Few resources exist that gives an overview of the field and what is available, is often of a highly technical nature. For this reason, the course aims at providing a solid understanding of the principles in a short time.

The purpose is not to create experts, but to give enough background knowledge to individuals to know the possible areas of importance that need further research for the cases they are involved in.

The course should also be useful for anyone considering a career in digital forensics, to understand the difference between digital forensics and computer security. This is important, as the perception is often that digital forensics is about hacking, something that is certainly not the case.

Only a very basic knowledge of computers and no legal background is assumed.

The course will cover the following:

• The authorization that is needed to collect electronic evidence
• Where we can find electronic evidence and the types of evidence associated with certain crimes
• The methods used to acquire electronic evidence from computers and mobile devices
• How to protect evidence from tampering
• How electronic evidence is analysed
• The contents of a forensic report that is needed for court purposes

A list of freely available software that can be used for forensic purposes are also given.