PECB Certified Lead Computer Forensics Examiner
Master the judicial investigation process
The target audience for training
- Computer forensics specialists
- IT forensic consultants
- Cybersecurity professionals
- Cyber intelligence analysts
- Electronic data analysts.
- Computer evidence recovery specialists
- Professionals working or interested in law enforcement
- Professionals wishing to deepen their knowledge of computer investigation analysis
- Members of the information security team
- Specialist IT consultants
- Persons responsible for examining media in order to extract and disclose data
- IT specialists
What you will learn
The Lead Computer Forensics Examiner course will give you the expertise you need to carry out forensic investigation processes to obtain complete and reliable digital evidence. During the course, you will also gain an in-depth understanding of the fundamentals of computer forensics, based on the best practices used to implement the forensic evidence recovery process and analytical techniques.
This course focuses on the basic skills needed to collect and analyse data from Windows, Mac OS X, Linux computer systems and mobile devices. Once you have mastered all the concepts relating to the computer forensics process, you can sit the exam and apply for the title of "PECB Certified Lead Computer Forensics Examiner". By becoming a PECB Certified Lead Computer Forensics Examiner, you will demonstrate that you have the expertise to lead advanced forensic investigations and perform forensic analysis, reporting and evidence acquisition.
Training programme
- Duration: 5 days
Day 1: Introduction to incident response and IT investigation concepts
- Exploring ISO 27037
- Scientific and legal principles relating to judicial data processing
- Fundamentals of incident response and computer forensics
- Exploration of best practices mentioned in various DoJ and NIST guidelines
- Computer forensics laboratory requirements
Day 2: Preparing and leading a computer forensic investigation
- Computer crime survey and digital investigation
- Common operating systems and file systems
- Mobile devices
- Maintaining the chain of evidence
- Policies and procedures for maintaining the chain of evidence
Day 3: Analysis and management of digital artefacts
- Introduction to open-source and commercial tools
- Identify, acquire, analyse and communicate digital artefacts
- Use of IT investigation tools and free tools
- Incident simulation
Day 4: Case presentation and simulation games
- Emerging threats
- Presenting forensic numerical results
- Presenting evidence in court
Day 5: Certification Exam
Examination "PECB Certified Lead Computer Forensics Examiner meets the requirements of the PECB examination and certification programme. The examination covers the following areas of competence: Duration: 3 hours
- Area 1: Fundamental principles and concepts of computer forensics
- Area 2: Best practice in computer forensics
- Area 3: Digital forensic laboratory requirements
- Area 4: Operating system and file system structure
- Area 5: Mobile devices
- Area 6: Computer crime investigation and forensic examination
- Area 7: Maintaining the chain of evidence
Training objectives
- Understanding the roles and responsibilities of a Lead Computer Forensics Examiner during a computer forensics investigation
- Understand the purpose of the electronic media review and its relationship to common standards and methodologies
- Understand the correct sequence of steps in a computer incident investigation and digital forensics operation
- Understand the common and open source tools that can be used during an incident investigation and digital forensic operation
- Acquire the skills needed to plan and execute a computer forensic operation, and implement and maintain a security network to protect evidence
Training prerequisites
Training PECB Certified Lead Computer Forensics Examiner requires basic computer skills (systems, networks, files), familiarity with cyber security, and ideally experience in computer forensics or information security. Although not compulsory, these skills are strongly recommended if you are to follow the course effectively and pass the exam. An understanding of technical English may also be useful.
Examination guide
Download the exam guide
- Level : Fundamental
- Certification body : 0
- Certification: Yes
- Accessibility : Yes
- Duration: 5 days
Important information:
Our courses are not registered with the Répertoire National des Certifications Professionnelles (RNCP), but they do comply with the requirements of the Répertoire Spécifique (RS).