Advanced Forensics Examinations
This advanced course introduces experienced forensic examiners with a systematic review of the functionality XP Pro. Anyone can find things when using automated forensic tools. Knowing how things work is how you give meaning to what is found and therein lays the proof of intent by the computer user. Emphasis is placed upon the functionality of the GUI Interface of XP Pro and the artifacts left behind by its use. The student will be exposed to an depth review of key areas like the Recycle Bin, Norton NProtect Folder, Internet Explorer 6, the Registry Hives, Date/Time Stamps, Link files, Restore Points, User Profiles to name a few. Knowledge of NTFS and FAT32 file systems is a prerequisite as the file system themselves will not be addressed.

This advanced Forensic Evidence course is recommended those students who have completed the basic course or for experienced examiners. This course will provide the experienced examiner with the necessary foundation about how things work to handle tough questions.

Students with established forensic methodology are encouraged to use their own licensed forensic software, notebook computers, etc. for this course.

For more information on this, please contact Dr. Brian Swords at 864/646-1731, 864-260-6741 or bswords@tctc.edu.

• 1-3 months of training
• $750 (with a discount for law enforcement, military, government employees and educators.)