Forensic Computer Examiner

Certificate Program

The California State University, East Bay Forensic Computer Examiner Certificate is an authorized Certified Computer Examiner (CCE) training program. It thoroughly prepares aspiring examiners for the CCE exam and provides them the skills and knowledge they need to enter this ever-expanding field. The author of the curriculum holds the distinction of being U.S. Customs' first computer examiner in Miami, Florida.

Those who take advantage of Cal State East Bay's nationally recognized program will immerse themselves in topics that range from forensic examination procedures and ethical standards to presenting data in court. Students will test their skills by examining a hard disk drive that includes the full range of forensic issues addressed.

Offered in partnership with Gatlin Education Services, the program's online-only format makes it convenient for professionals anywhere in the world, not just those who live or work in the San Francisco East Bay Area.

Program Objectives

• To give graduates a strong understanding of the obligations of a forensic computer examiner and provide them the skills and confidence necessary to meet the highest professional and ethical standards.
• To prepare graduates for the CCE exam and to tackle the challenges they will face as forensic computer examiners.
• To give graduates an understanding of how to properly acquire, collect, or seize magnetic media, how to prepare and verify forensically sterile examination media and how to properly establish and maintain the physical "chain of custody" of media and evidence.
• To give graduates familiarity with the wide range of technical topics a forensic examiner must understand, including the logical structures of DOS and Windows, the NTFS partition table, boot record and root directory, the MTF, bitmaps, NTFS headers and attributes, resident and non-resident files and the NFTS registry "hive," among many others.
• To provide graduates a basic understanding of the legal privacy issues relating to the examination of magnetic media and the ability to determine when a legal opinion may be necessary to prevent privacy issues from interfering with the examination or causing a valid lawsuit.
• To give graduates an understanding of how people commonly try to hide data, along with the ability to find and document normal data and graphical files, find and document data in unallocated space and lock and unlock many passwords.
• To give graduates the ability to recover single and multiple cluster deleted files, long file names, subdirectories and other data, including data from swap files, temporary files, Internet cache files, cookies, mail files and Web sites visited.
• To provide graduates a grounding in basic imaging methods and making exact copies of media, along with critical skills such as preserving original media, safely handling media and preventing inadvertent writes and the activation of "booby traps."
• To give graduates skill in preparing and analyzing investigation results and reports and presenting recovered and evidence data in a clear and understandable manner, to clients, employers and in court or other proceedings.

Who Should Attend

• Individuals who seek to become forensic computer examiners.
• Individuals who seek to prepare for the Certified Computer Examiner (CCE®) exam.

Program Highlights