Diary of a Computer Forensics Student

The second semester of my final year started today.

There structure is as before* some modules* some project* for about 12 weeks. This semester though* along with continuing project work and a module about commercialisation and business* there is more forensics* a whole 3 month module of it. The connection with AccessData that we experienced over the first and second year remains – we will be working with 3 versions of FTK* Registry Viewer* PRTK* Mobile Phone Examiner – Ultimate Toolkit. Excitingly – well* it excites me – the university has acquired some licences for EnCase. I have used Encase a little – enough to find my way around* but the chance to work with it on a more regular basis is obviously really useful. Another thing that piqued my interest is the fact that there is some focus on open source and free applications.

To me this signifies that the tutors/lecturers are serious about the students understanding what they are doing. OK* open source tools still have some automation* but we are making sure to keep away from becoming button-pushers* that can only use software* and are not really performing tasks forensically – the tool is doing it for them. The more we vary our tools and methods* the more we understand what they are doing* because each requires a different approach or does a different thing. This is a continuation* not something ne – our main tutor has always made sure that FTK has just been the way in – we know what it’s doing when it carves a file etc etc etc.

The next piece of great news is that there will be some ‘masterclasses’ – lectures and sessions from practising forensic examiners. Not computing experts who have done a course* not forensic academics (valuable as they cane be)* but people who are doing the job 9-5 (and the rest!). These should be extremely useful and enjoyable – we can narrow down what we’re learning to do to things they tell us are useful – this is something I’ve tried to do throughout the past 18 months – get a realistic idea of what is good to know and learn* and do that – as well as doing the academic work* and forensic content at uni. These masterclasses will greatly help this. Can’t wait!

Overall* my current understanding is that we will be carrying out examinations* working theoretical cases using varying tools* with lots of good teaching input. Sounds good to me.

PS. I too am deeply annoyed by the asterisks-for-commas thing. Sorry.

Ryan

• IP Address
• |
• Email Blog Entry