RT101, Introduction to Computer Search and Seizure (ICSS)
Who Should Attend:
DCIO/MCA investigators and prospective lab examiners.
Prerequisites:
NONE
Duration:
3 Days
Course Description:
The ICSS course introduces students to the commonly used and accepted procedures for recognizing
and seizing computer-related evidence. Emphasis is placed on the protection of original digital
media, evidentiary chain of custody, and documentation of procedures. The implications of related
legal statutes are also discussed. {Mobile}
Objectives:
- Evaluate a computer-related crime scene for evidentiary value
- Determine what devices will be seized according to individual offenses and crimes
- Implement proper shutdown procedures for various computer operating systems
- Successfully secure electronic media in accordance with proper evidence handling procedures and chain of custody concerns
- Document the results of the initial search in a manner that will withstand judicial examination
- Discuss the judicial implications of related legal statutes
Topics Covered:
Computer Hardware
- Safety
- Hardware and Media Familiarization
- Data Wiping
Computer and Digital Crime Basics
- Computer Crime and its Life Cycle
- Common Computer Environments
- Understanding the Digital Crime Scene
- Crime and Associated Data Types
Computer Search and Seizure
- First Response and Processing On-screen Data
- Shutdown procedures
- Conducting an External and Internal Examinations
- Packaging and Transportation