FRN 7860 Hardware Fundamentals for Law Enforcement

Instructor: Majid Hassan, High Technology Crime Investigation Association
This course is a prerequisite to any computer forensics course at the American Academy of Applied Forensics. It is an introduction to basic hardware concepts of PC systems and provides an intense coverage of computer hardware and the functionality of the inner components. Students will learn to recognize and manipulate the main components of a typical PC and understand their functions. They will disassemble a computer in its entirety and rebuild it from the motherboard up. Students will also build a PC from scratch and load the operating system. By the end of class, students will be well versed in the basic functions of major PC hardware and component technology and be able to build a computer in class. Successful completion of this course prepares students to pursue training in computer forensic examination that requires a thorough knowledge of hardware components.

FRN 7861 Digital Evidence Courtroom Testimony

Instructors: Various Assistant US Attorneys and Assistant District Attorneys
This course provides an assessment of what to expect in the courtroom when a digital evidence case is involved, as well as the requirements for delivering expert testimony. It covers the current status of forensic digital evidence from both the scientific and legal perspectives in both criminal and civil cases. Students will see a mock trial for both types of cases, including an expert witness providing testimony for digital evidence. Students will also see the process of qualifying an expert in court by prosecution and defense. During the case mock trials, students will receive the opportunity to role play in qualifying the expert by asking questions that can open discussions about what to anticipate in the courtroom. Students will learn to identify and have an opportunity to discuss prospective issues and their potential resolutions regarding digital evidence investigation, examination, laboratory accreditation, and use at trial.

FRN 7879 Best Practices for Seizing Evidence

This Online course is primarily for First Responders but is also a good review for experienced investigators when it comes to seizing digital evidence. The course covers the seizure of both home and network computers. Details involving safe handling of cell phones, PDA’s, storage media and camera’s are also covered. The course discusses the potential digital evidence found in computer logs, documents, address book lists and other areas of the computer where evidence can be found. Standard operating procedure for safeguarding evidence when seized and transported is covered in this course. Investigative questions for targets and victims are reviewed. The course is an excellent source of guidelines used for search warrants.

FRN 7863 Financial Terrorism

Instructors: Majid Hassan, Tony Marino and Dale Callan
This course covers financial crimes, their relationship to terrorism and the resulting digital evidence that is created. Students will learn how terrorism has been funded using typical financial transactions as well as illegal methods of securing funds. The course will cover financial crimes including identity theft, phishing, money laundering, etc., and their role in global crimes that result in threats to people, infrastructure and geography. Students will learn the investigative approach necessary to follow the trail of digital evidence left behind by financial crimes that fund terrorism.

FRN 7864 Advanced Identity Theft and Electronic Crimes

Instructors: Dale Callan, AAAF-Staff
This course is an advanced course on all facets of Identity Theft which will emphasize the use of electronic crimes and the internet investigations involving Identity Theft. Students will cover the major issues including credit card, bank and financial crimes relating to these investigations. The class will discuss and identify phishing schemes and other social engineering tactics used by criminals today. Many investigative techniques used by federal agencies to catch these thieves will be covered in detail. Students will use computers to learn more internet search engines and other techniques and receive software that will assist their investigations. Extensive video’s, online investigations and the US Secret Service electronic crime training will be used. This is a must course for any investigator involved with financial crimes and internet investigations.

FRN 7865 Cell Phone Forensics- 16 hours

Instructors: Chris McNeil, Charlotte Mecklenburg Police Department
This vendor neutral training will introduce the student to the dominant cell phone technologies currently used throughout the U.S. and overseas - GSM and CDMA/TDMA. Upon acquiring a basic understanding of the various systems and their functions, the student will then be introduced to the various data fields contained on handsets (CDMA/TDMA/GSM) and SIM cards (GSM only).  An explanation of how the various data fields can be recovered and the importance of these fields to the examiner will be covered. Upon acquiring a basic understanding of the various systems and their functions, the student will then be introduced to the various data fields contained on handsets (CDMA/TDMA/GSM) and SIM cards (GSM only).  An explanation of how the various data fields can be recovered and the importance of these fields to the examiner is also covered. Hands on practical exercises with our software and equipment will provide the student with experience on extracting data from cell phones

FRN 7866 Introduction to Cybercrimes

This course provides a basic understanding and a review of cybercrimes. Internet related electronic crimes, their background and how they affect the public and law enforcement today are covered in this lecture course. Terrorist issues, the roles of federal law enforcement, regional task forces and cyberspace as a target are covered. Computer evidence and prosecutive issues will provide the student with a good overview of cybercrimes. This class will set a foundation for other electronic crime and online investigatory classes.

FRN 7867 Computer Crimes Against Children

Instructors: Special Agent Phil Osborn, Department of Homeland Security and Detective Tom Kolpacki, Ann Arbor Police Dept, Michigan
This course focuses on child exploitation issues and the Internet. Students will learn how to capture evidence of online abuse of children. The course covers technical investigative procedures that are used to capture online child predators. Practical experience in class includes the use of free tools and the Internet; in addition, students will also learn how to establish investigative units online. Child exploitation laws, evidence and search warrant issues will also be covered.

FRN 7868 Preliminary Computer Investigative Techniques-24 hours

Instructor: Steve Hickey, Insight Computer Forensics, Charlotte, NC
This course is designed to provide the student with a basic knowledge of how a computer works, how the Internet works and additional topics investigators may need to more effectively operator a computer. Topics will include MS word areas, multi-media use, windows basics, installing new programs and email along with an overview of Excel and Powerpoint . Students will go on class computers and do practical exercises to enhance their computer knowledge and skills from basic copying, scanning, learning to be more organized, loading software, copying and pasting and finding keyboard shortcuts. Internet details will involve browsing concepts, hperlinks, searching and finding favorites, history along with a basic understanding of connections, wireless and background information. After completion of this course law enforcement investigators will be able to handle simple computer investigations, organize cases and evidence and be able to save appropriate documents for future needs.

FRN 7869 Digital Search & Seizure for Patrol Officers

This course is a combination lecture course which sets an overview of digital evidence and the variety of electronic storage media that may be found or observed during vehicle stops and searches. Students will obtain a brief outline of search and seizure guides and consent search issues and then participate in practical search exercises of vehicles which will contain numerous items of digital evidence. This class will provide patrol and investigative officers an excellent overview of digital evidence found in vehicles today.

FRN 7870 Search & Seizure of Electronic Evidence

Instructors: Various North Carolina Police Departments
This course is an introduction to electronic media devices (computers, cell phones, PDAs, etc.) and the mechanics of seizing them. Students will explore innovative hardware technology used to commit computer-related crime and the legal ramifications of searching electronic media. Class includes extensive practical exercises in the search and seizure of electronic media in various crime scenes. Upon completion of the course, students will be able to recognize electronic evidence, build a search warrant for a digital evidence case, properly search and seize digital evidence in a crime scene, properly document property seized in an electronic crime scene, and properly submit and safeguard integrity of digital evidence for a laboratory examination.

FRN 7871 Introduction to Computer Forensics

Instructors: Various Field Practitioners/ Steve Hickey, Insight Forensics, Charlotte Prerequisite: Hardware Fundamentals for Law Enforcement or equivalent training/knowledge
This course teaches students how to identify, acquire, analyze, and report on computer-based investigations involving Microsoft-based operating systems. It covers hard disk geometry in depth from the physical construction to the logical function, as relevant for a computer forensics specialist. The course also provides a thorough examination of MS-DOS-based file systems and their forensic purposes, including an introduction to NTFS. Students will obtain hands-on experience working with hard disk geometry, data allocation processes, and data recovery methods. In addition, students will use imaging tools to learn proper evidence acquisition methods and will learn how to create a forensically controlled boot environment, as well as to perform some forensic analysis procedures. This course focuses on building knowledge fundamentals required to properly acquire binary data so that an investigator can proceed with a computer forensic examination. Students will complete the beginning elements of a computer forensic examination from secure data acquisition to analysis. An introduction to reporting is included in the class, but covered more thoroughly in the Intermediate Course.

FRN 7872 Intermediate Computer Forensics

Instructors: Various Field Practitioners/ Steve Hickey, InSight Forensics, Charlotte
Prerequisite: Introduction to Computer Forensics
The Intermediate Computer Forensics course builds on the concepts covered in Introduction to Computer Forensics. Students should already be familiar with acquisition of data and imaging processes on Microsoft-based operating systems. This course covers some of the more advanced features of operating systems including the forensic capturing of volatile memory. The course also examines operating system behavior and its forensic significance. Students will receive hands-on experience working with NTFS examination tools. More focus is given in this course to the analysis and reporting functions of computer forensics. This course focuses on building the proficiency of the forensic examiner by using advanced analysis tools and techniques, and developing the reporting mechanisms of a computer forensic examination.

FRN 7873 Advanced Computer Forensics

Instructors: Steve Hickey, Insight Forensics, Charlotte
This course builds on the proficiency of forensic examiners. More focus will be given to more difficult practical exercises where the student will forensically search for emails, internet history and use advanced searches using forensic software. Our Intermediate computer forensic course is a pre-requisite unless the student is already an experienced forensic examiner. This course is designed to make forensic examiners find more difficult files and data while improving their current skills. Students will produce reports for court testimony that will describe deleted disk space and other technical strategy used to enhance their testimony. Chain of custody forms and varied presentations to prosecutors will enhance the examiners skill. Live scenarios will be used to learn more difficult techniques in finding important evidence in a timely matter. Upon completion of this course, students should be able to: Recognize and evaluate more difficult forensic searches. Build their expertise in all areas of examinations so they are able to improve reports and testimony and overall knowledge of forensic exams.

FRN 7880 Credit Card Fraud & Digital Evidence

This Online course will introduce the student to all types of credit card frauds but will concentrate on digital evidence and computer issues. The course will cover phishing, data mining, ATM fraud, ID Theft related fraud with credit cards along with various computer-cybercrime fraud. The course will cover investigative tips and sources for gaining information and assistance for investigators. A discussion on state and federal credit card violations will assist the investigator in determining the best statutes to use and how they fit the crime. New technology on no swipe cards and the differences on debit vs credit type cards is also covered. This class is a must course for financial crimes and credit card investigations.

FRN 7874 Internet as an Investigative Tool

Instructors: Special Agent Phil Osborn & Detective Tom Kolpacki
This course provides a comprehensive coverage of cyber crime. It covers various Internet crimes as well as traditional crimes that are facilitated by the Internet. Students will learn investigative tactics for various types of cyber crime including, but not limited to: fraud, identity theft, hacking, piracy, child exploitation, e-mail, illegal drugs and narcotics crimes, domestic and international terrorism, stalking, money laundering and financial crimes. This class involves hands-on activities that will allow each student to use the various investigative software, tools and utilities provided in class.

FRN 7875 Online Investigations

Instructors: Steve Ingram, Detective, Davidson Police Dept, Dale Callan, AAAF-Staff & Steve Hickey, InSight Forensics, Charlotte
This course is an introduction to cyber crime and the study of network forensics. Using the Internet as an investigative tool, the course focuses on the basics of networking and inter-networking. Students will learn the types of attacks that exist in cyber crime, how these attacks are performed and how law enforcement can trace the origin of this criminal activity. Cyber crime tactics covered are virus creation (including Trojan horses), web and database hacking into business and personal systems, network sniffing and/or network spying, encryption, etc. Students will also learn the kind of information that can be compromised during a network attack. In addition, students will learn to trace e-mails and computer IP addresses to begin an investigation of cyber-criminal activity.

FRN 7876 On-Scene Computer Forensics

Instructor: Gary R. Cullop, North Carolina State Bureau of Investigation
This course provides an introduction to live computer forensics. It covers recognized tactics used at the crime scene to view computer-use activity prior to seizure. Students will learn how to view the contents of a computer prior to seizure without actually altering information on the machine. The course uses Linux utilities that can be used on a Windows-based machine and provides an introduction to the Linux Operating System. Students will obtain hands-on experience working with similar incident response tools. The course also covers the legal issues of searching a computer prior to seizure along with consent-to-search protocols. Students should know how to use a PC and have basic knowledge of computer systems.