Internet Evidence Analysis
Course details
2024
| Session(s) | Location | Start date | End date |
|---|---|---|---|
| 24-01 English | Ottawa | 2024-01-22 | 2024-02-02 |
| 24-02 English | Ottawa | 2024-04-08 | 2024-04-19 |
| 24-03 English | Ottawa | 2024-09-30 | 2024-10-11 |
| 24-04 English | Ottawa | 2024-11-11 | 2024-11-22 |
| Tuition |
|---|
| $5,150.00 |
Notes
- Accommodations are offered to course participants. Our rooms are subject to availability and the request must be indicated on the course registration form
- Meal plans are offered to course participants. The specific meal plan must be indicated on the course registration form
- Travel grant funding is available to our non-federal law enforcement agencies
2025
| Session(s) | Location | Start date | End date |
|---|---|---|---|
| 25-01 English | Ottawa | 2025-01-20 | 2025-01-31 |
| 25-02 English | Ottawa | 2025-05-05 | 2025-05-16 |
| 25-03 English | Ottawa | 2025-09-29 | 2025-10-10 |
| Tuition |
|---|
| $5,400.00 |
Notes
- Accommodations are offered to course participants. Our rooms are subject to availability and the request must be indicated on the course registration form
- Meal plans are offered to course participants. The specific meal plan must be indicated on the course registration form
- Travel grant funding is available to our non-federal law enforcement agencies
Description
The course provides the knowledge and skills to conduct a forensic examination on computer systems for Internet artifact evidence created by various software applications on a Microsoft Windows operating system. Artifact evidence created by these various applications ranges from settings, to log files, and to files created as a result of application use. The most widely used applications are explored, including web browsers, email, instant messaging, peer to peer, social networking, webmail and cloud platforms. From here, course participants then learn how to apply these skills to new applications or application versions where available digital forensic tools may be less capable or where a deeper exploration of artifact evidence is needed.
Format and delivery
- Length of course
- 10 days
- Class size
- maximum 20 participants
- Delivery setting
- theoretical and practical components are done in a computer laboratory
Learning outcomes
- Knowledge of basic Internet communication protocols and content.
- Ability to process forensic artifact evidence created by web browsers.
- Ability to locate forensic artifact evidence created by popular instant messaging clients.
- Understanding how to assemble forensic artifact evidence created by peer-to-peer clients running on a Microsoft Windows operating system.
- Understanding how to identify artifact evidence created by social networking websites on the Internet.
- Knowledge of the legal issues pertaining to online investigations.
Eligibility and mandatory requirements
- This course is offered to law enforcement officers and civilian computer forensic analysts who:
- have been part of a technological crime unit for at least two years
- have basic skills in the use of a current leading forensic software tool
- Registrants must have completed the Computer Forensic Examiner Course (CMPFOR). In absence of CMPFOR, considerations is given to experienced computer forensic examiners, preferably with two years' experience.
- Acceptance or refusal in the course is at the discretion of the Canadian Police College.
Assessment
- Success in the course is based on participation and completion of all required assignments.
- Various evaluation methods are used, including a written exam, practical exercises and mapping exercises.
- Re-testing or re-evaluation is conducted at the discretion of the course instructor.
Contact
For more details or other information about the course, please email cpc_registrar-registraire_ccp@rcmp-grc.gc.ca.
- Date modified: