There are five main components to computer forensics these being: identification; collection; preservation; analysis and presentation; of computer forensic evidence and each one of these components is important on its own. The underlying concept in computer forensics is to ensure limited or no handling of the original evidence and to make certain all the steps are followed to satisfy the evidence presented before the court will stand the test of the law.
Each case and each device are different hence there is no one solution to every investigation and an investigator needs to adapt to each given investigation. There are also many automated tools now in operation and though these may extract a plethora of data from a device, it is essential for an investigator to understand how the tools work and how the extracted data is presented. Failure to do so could result in the exclusion of the evidence if it cannot be explained how the data was obtained.
This course will introduce many of these tools and how and when to use them. If you want to get into the industry and do well and obtain a job in this area or just improve your skillset then this is the course for you.
