Uncovering the Truth – An Insight Into IT Forensics

We are detached from the data that is recorded in our systems and, for the most part, this is beneficial allowing us to concentrate on organisation and process. However, when we need to probe more deeply, because we suspect abuse, error or fraud, we find we don’t know where to begin.

This course provides a simple and stimulating introduction to the search and retrieval of data from systems using low or zero cost software tools.

Suitability and duration

Suitability: All

Duration: 1 day

Who should attend

Those responsible for investigating civil or breach of conduct matters will find this course of greatest practical benefit. The course uses a mixture of briefings and displayed software activities. No in-depth IT knowledge is required.

Benefits

Skills

After completion of this course, you will be able to:

• Assemble a toolkit of valuable search and retrieve utilities at low or zero cost;
• Understand and explore possibilities of recovering lost, damaged or corrupted files, images, passwords and other important data using specialist software or third party experts in the conduct of an audit; and
• Discriminate between reliable and unreliable information

Support Materials

This course will be accompanied by a training manual containing briefing materials, examples and practical advice. Additionally a CD of software for personal use will accompany this event.

Programme

The Fundamental Processes

• Searching computer systems and files – caveats
• Examination of cache files and system information: browser histories, cookie libraries, licences, auto-start programs, installed programs, services
• File attributes – low level viewing of files as hex and as text, why look at hex?
• Search hex – search text
• Locating text hidden in files – complex searches
• Comparing files and text
• Hashes and elimination and identification of files using hashing
• Disk and file cloning – exact copies
• Recovering deleted files
• Recovering passwords and identities
• Searching for images
• Fuzzy time, records authenticity, log tampering, corruption and data loss