Forensic Computing

Hello

I am currently studying a Masters in Computer Forensics and Security at the University of Derby and was wondering if anyone has any advice on any courses or training i can do to supplement my Masters?

I have done some work with EnCase but the course is a bit expensive for me so i am wondering what other qualifications are useful to have to get into computer forensic, specifically the investigation side of things?

Also, does anyone know of any computer forensic specific job sites?

Thanks
 
I've only done parts of a CF Masters degree so I don't know exactly what it contains, but my guess is it teaches you all the theory you need to know (at a most basic level, how file systems work). I went into CF without a degree, but we've been given a similar thing through a university which teaches us most of the theory.
The other courses, Encase and AccessData (who make FTK) are mainly software training and backing up your knowledge specific to the scripts they run. They're definitely useful and would probably give you a leg-up into any investigative role. Encase has a scripting function so some programming experience would also be helpful, although there are already scripts for pretty much everything you need so that's not at all essential. But overall, I'd say you're pretty well set with your Masters - certainly don't wait for additional training before looking for a job.
 
Thanks for the information, unfortunatly we havent been taught a lot on how file systems work so maybe this is something i should look into and get more familiar with. The course i am studying unfortunatly is a bit heavy on the security side with quite a limited forensic content, we have basically been shown a bit of Encase and FTK, a couple of law modules about the legal side of computing and how to present evidence to a court and how to collect and store evidence but this has been quite limited.

I have had quite a bit of programming experience although it has been a couple of years since i have really touched on it. I am doing my dissertation over the summer and was thinking about possibly trying to do the EnCase course at the same time, would you reccomend this or should i just wait until i get a job where i have heard EnCase is usually provided?

I have come accross Winhex before, its quite a useful little tool although i am still a relative novice in using it.
 
Obviously it'll be different for different aspects of CF, but certainly for where I work file systems are important because you need to stand up in court say 'This is how Windows stores data, and this is how Encase recovered this deleted file', even if when you're doing the investigation you're pretty much relying on the software to do it all for you.
Personally, I'd wait for the job to offer you Encase training - you're going to learn most of it as you go anyway and it only takes a couple of weeks to become familiar with the basic aspects of the program. If the job has a decent training path the Encase training probably won't teach you much more than you learnt in the office anyway.
(However, this is just the way I've come into the job...If you've got the money to spare maybe some Encase training would be a good idea. But it doesn't come cheap)
 
Last edited:
Oooh this thread is relevant to my interests.

Currently doing my final year dissertation in computer forensics.

My Blog

Unfortunately I've hit a massive wall with regards to application/virus signatures which is quite infuriating. Anyone happen to know about such things?
 
Cool. I've added you. :)

All help is good. Been trawling papers and stuff, most just seem to say programs use signatures to detect but that's about it.
 
You must log in or register to reply here.
Back
Top Bottom