Computer Forensics Courses - Comparisons

[Disklabs]

Does anyone have any knowledge of Computer Forensics in Academia? there have been many complaints that universities are giving out 'Masters' and degrees in computer forensics, yet their courses are not particuarily good?

[Chantelle]

I'm currently studying BSc Forensic computing at bristols UWE and i've found you tend not to go into too much detail on the forensics side of things in the first year as they like to cram alot of the programming/web developing into you to start with.
Alot of the universities say you dont need prior computing knowledge but if I had started this course without knowing a wee bit I would have been stuck, they really chuck you in the deep end.
Looking forward to having a play around with EnCase etc soon:D

[qwerty]

I'm currently studying BSc Forensic computing at bristols UWE and i've found you tend not to go into too much detail on the forensics side of things in the first year as they like to cram alot of the programming/web developing into you to start with.
Alot of the universities say you dont need prior computing knowledge but if I had started this course without knowing a wee bit I would have been stuck, they really chuck you in the deep end.
Looking forward to having a play around with EnCase etc soon:D

Well I can only comment on studying CF at Northumbria, but I found even the second year to be lacking in detail. Whilst we were shown how the likes of FTK and EnCase work, we've yet to actually been shown or been allowed to image hard drives ourselves. We've had to work on previously created images. One of the requirements employers ask for is the ability to image and without the prior practice, I would struggle to get the job.

Agree about the University saying you don't need prior computing knowledge. Stuff like the BIOS plays a really important rule in CF and knowing the insides of a computer is really important too. These were two areas I got asked on when I was having a phone interview for a placement with Nottingham Police. It was lucky that I had knowledge of both those areas through having my own computer at home and through my own research.

[Minesh]

Hi Querty,

Having not attended any CF training, I started practising on my machines and friends and families machines. If you have some spare time, you can try out different methods of imaging for yourself.

You can use Helix, FTK Imager, or the original DD, or a number of other tools. It's always worth putting in some extra work, as you will find most university courses don't teach you everything you need to do a job.

Kind Regards,

Minesh

[qwerty]

Hi Querty,

Having not attended any CF training, I started practising on my machines and friends and families machines. If you have some spare time, you can try out different methods of imaging for yourself.

You can use Helix, FTK Imager, or the original DD, or a number of other tools. It's always worth putting in some extra work, as you will find most university courses don't teach you everything you need to do a job.

Kind Regards,

Minesh

Don't you need the proper kit? stuff like a write blocker etc?

[Minesh]

Don't you need the proper kit? stuff like a write blocker etc?

Yep, in real cases you would, but for the sake of practice, it shouldn't matter too much... its just so you get an idea how to image and mount the image etc.

Kind Regards

[qwerty]

Yep, in real cases you would, but for the sake of practice, it shouldn't matter too much... its just so you get an idea how to image and mount the image etc.

Kind Regards

Do you have the full versions of the likes of FTK? as the version I have has a limited number of files you can image.

[Minesh]

Grab FTK Imager Lite from here: http://www.accessdata.com/common/pagedetail.aspx?PageCode=downloads

I have used that before. I know the actual toolkit is limited by the demo, and possibly the full imager may be too (although I'm not certain about that), but the Lite version isn't, and it's portable.

HTH

Kind Regards

Minesh

[qwerty]

Grab FTK Imager Lite from here: http://www.accessdata.com/common/pagedetail.aspx?PageCode=downloads

I have used that before. I know the actual toolkit is limited by the demo, and possibly the full imager may be too (although I'm not certain about that), but the Lite version isn't, and it's portable.

HTH

Kind Regards

Minesh

ok thanks.