Emory Computer Forensics CCE Course

The Emory University Difference

In an increasingly competitive job market, an Emory education can help to set you apart. Emory University is the only top 20 university in Georgia, as ranked by US News & World Report in 2008. Graduates from our program are fully prepared to obtain their International Society of Forensic Computer Examiners (ISFCE)™ Certified Computer Examiner (CCE)® credential.

Expert Instructors

Our instructors are all Certified Computer Examiners (CCE)® who are currently involved in computer forensic examinations. They will coach and tutor you through the practical exercises, reports, and test questions for each module. Our instructors are highly qualified, experienced and understand forensic examination standards and practices far beyond the material in this course. 

Hands-on Learning

The course includes a series of practical exercise problems in the form of specially prepared diskettes, CD-ROMS or hard disk drives that must be examined. These exercises reinforce the material and teach "hands-on" forensic skills. A case scenario will be used in which a fictional private investigator brings you, the examiner, diskettes for examination. Each diskette will build to the next exercise, until a complete hard disk drive has been examined and the case is concluded. These practical exercises cover real-life computer forensic issues.

Program Information

The Emory Computer Forensics CCE Course is an intensive one week classroom and laboratory training course in computer forensic examinations that demonstrates how to conduct forensically sound computer examinations and prepares you to take the CCE certification examination.

Why take this class?

If you plan to testify in court, you the examiner, not the automated software product, must qualify as an "expert" witness. As an expert witness, you must know and be able to articulate what your automated software is doing.

Our course teaches you how data is stored, where the data is located and how to recover all of the data. Our students learn how to conduct thorough examinations and how to explain, interpret and draw appropriate conclusions about the data that is uncovered during examination. Regardless of the automated product you use, after this course, you will understand how the product works and will be able to explain or testify about the results of your examination and how those results were obtained. This program provides participants with the knowledge to conduct thorough examination, regardless of the tools you use.

Our course will teach you the core forensic procedures that apply to examining any operating system or file system, with emphasis on Windows-specific file systems. During the course, we provide instruction on the logical structures of the FAT file system utilized by DOS and Windows 9.x and the NTFS logical structures utilized by Windows NT, 2000 and XP. Our instructors have thorough knowledge of both FAT and NTFS operating systems.

The training you receive in this course focuses not only on forensic recovery techniques, but on ensuring that what you find can be admitted in court. You will learn how to establish and use proper evidence handling procedures and how to conduct examinations using sound forensic examination procedures.

Who should take this class?

Both current and aspiring Computer Forensics Professionals will benefit from the thorough instruction included in our course curriculum. This program is especially relevant for those who plan to testify in court.

Course Curriculum Outline

This course will cover all aspects of forensic examination, including:

• Forensic ethical issues
• Forensic examination procedures
• Preparing and verifying forensically sterile examination media
• Basic operating system issues
• Hardware issues specific to forensic examinations
• Basic network issues
• The proper methods to initially acquire or seize original media and minimize the potential for loss or corruption of data
• How to preserve original media and prevent accidental writes to or alteration of the original media
• How to find and recover data on media from all file types
• The significance and determination of various date and time stamps
• Data types, data format conversion and managing data
• Note-taking and accurate report-writing
• A detailed overview of FAT and NTFS logical structures
• Presenting the data to the client or attorney in a manner that is clear and understandable
• How to draw expert conclusions

To learn more about the course material, click here.