Master the Computer Forensics processes.

Lead Computer Forensics Examiner training enables you to acquire the necessary expertise to perform Computer Forensics processes in order to obtain complete and reliable digital evidence.

During this training course, you will also gain a thorough understanding of Computer Forensics fundamentals, based on the best practices used to perform forensics evidence recovery and analytical techniques. This training course is focused on core skills required to collect and analyze data from Windows, Mac OS X, and Linux operating systems, and also from mobile devices.

For more information, please visit PECB .

Learning objectives :

  • Understand the roles and responsibilities of the Lead Computer Forensics examiner during digital forensic investigation;
  • Understand the purpose of electronic media examination and its correlation with common standards and methodologies;
  • Comprehend the correct sequence of steps of a computer incident investigation and digital forensic operation;
  • Understand the common commercial and open source tools that may be used during incident investigation and digital forensic operations;
  • Acquire the necessary competencies to plan and execute a computer forensics operation and also implement and maintain a safety network to protect evidence.

Who should attend?

  • Computer Forensics specialists;
  • Computer Forensics consultants;
  • Cybersecurity professionals;
  • Cyber intelligence analysts;
  • Electronic data analysts;
  • Specialists in computer evidence recovery;
  • Professionals working or interested in law enforcement;
  • Professionals seeking to advance their knowledge in Computer Forensics analysis;
  • Information Security team members;
  • Information technology expert advisors;
  • Individuals responsible for examining media to extract and disclose data;
  • IT Specialists.
  • Day 1: Incident Response and Computer Forensic Concepts:
    • Course objectives and structure
    • Standard and regulatory framework
    • Historical aspects of Digital Forensic
    • Basic concepts and definitions in ISO 27037
    • Overview of ISO 27037 standard
    • Roles and responsibility of CLFE
    • Computer Forensic Laboratory
  • Day 2: Prepare and Lead a Computer Forensic Investigation:
    • Technical Fundamentals
    • File System Forensic
    • Common File Systems
    • Common Operating Systems
    • Forensic Acquisition
  • Day 3: Digital Artifacts Analysis and Management:
    • Digital artifacts: Identify, acquire, analyze and communicate
    • Using open source forensic acquisition and analysis tools
    • ISO/IEC 27037:2012
    • Advanced Keywords searching with Regular Expression
  • Day 4: Case Presentation & Trial Simulation:
    • Decision-making of collection or acquisition of potential digital evidence
    • Other Essential Digital Forensic Topics
    • CLFE Professional Ethics
    • Presenting Digital Forensic Findings
    • Competence and evaluation of examiners
    • Closing the training

This training is based on both theory and practice:

  • Sessions of lectures illustrated with examples based on real cases;
  • Practical exercises based on a full case study including role playing and oral presentations;
  • Review exercises to assist the exam preparation;
  • Practice test similar to the certification exam.

To benefit from the practical exercises, the number of training participants is limited.

  • The “PECB Certified Lead Computer Forensics Examiner” exam fully meets the requirements of the PECB Examination and Certification Programme (ECP). The exam covers the following competence domains:
    • Domain 1: Fundamental principles and concepts of Computer Forensics
    • Domain 2: Best practices on Computer Forensics
    • Domain 3: Digital forensics laboratory requirements
    • Domain 4: Operating system and file system structures
    • Domain 5: Mobile devices
    • Domain 6: Computer crime investigation and forensics examination
    • Domain 7: Maintaining chain of evidence
  • The “PECB Certified Lead Computer Forensics Examiner” exam is available in different languages (trainers are fluent in English, French & Spanish);
  • The exam is available online, please refer to PECB Exams User Manual ;
  • Duration: 3 hours
  • For more information about PECB Certified Lead Computer Forensics Examiner exam and certification, refer to Lead Computer Forensics Examiner Exam & Certification .

Duration: 4 Days

Exam: Included

Certification : Yes

Next Course

Dates on request !

Download Brochure


Dates on request !