Nordic Computer Forensic Investigators - Module 3E Windows Forensics

Study information

• Your learning outcomes

  The aim of this program is to ensure that the quality of computer forensic investigation is of a high level, guaranteeing legal protection and the right to privacy.

  General competence

  After completion of the module candidates will be able to:

  • perform professional and research tasks in digital policing
  • see the role of digital policing in a broader perspective during an investigation
    
    

  Knowledge

  After completion of the module candidates will have advanced knowledge about:

  • Windows artefacts and data structures of potential interest in an investigation
  • Windows file systems
  • Windows operating systems

  Skills

  After completion of the module candidates will be able to:

  • Utilise open source forensic tools in Windows
  • manually interpret Windows file systems and artefacts
  • automate forensic tasks using Windows
  • evaluate the relevance of Windows artefacts in relation to an investigation

• Admission criteria

  The primary target group is police staff in the Nordic countries whose main task is handling and investigating digital evidence. It is a prerequisite that participants are selected in accordance with local competency plans.
  
  Employees in other International police services or governmental agencies who work, or will work, with digital evidence are also eligible to apply. 

  Applicants must be recommended by the employer.

  Admission criteria:

  • Bachelor’s degree
  • have passed NCFI M2A module.

  
  Applicants who do not satisfy the requirement for a bachelor’s degree must document the
  following:

  • Passed and completed 2-year education at a higher level than upper secondary school,
    and in addition either:
    • Minimum 60 ECTS
      • (of which NCFI Core Concepts of 15 ECTS and any NCFI M2X of 15 ECTS each. The former NCFI Module 1 (5 ECTS) and former NCFI Module 2 (25 ECTS) are also accepted.), or
    • 1680 hours of continuing education courses, or
    • 5 years of practice

  Employment, work experience and additional requirements:

  • Current employment in a government agency (e.g., law enforcement agency or other cooperating governmental agencies/organisations)

• Practical information

  The education is organised as an online part-time programme and must be completed within 5 months. The scope of further education is estimated to be approx. 210 hours of study.

  The mandatory reading shall not exceed 450 pages.

  The student needs to pass a number of course requirements in order to sit the exam. Students may have multiple attempts at these tests if necessary.
  
  The module is concluded with an individual take-home exam over 4 hours. The exam must be passed in order to successfully complete the module.

  Grading is on a scale of A – F (in which A – E are passing grades and F is a fail).

• Schedule for tuition and exam

  Exam: four-hour take home examination.
  Location: Online
  Date: 12.12.24

  Compulsory education
  Location:
  Date:

   

  If both are blank cours may not be running this semester.
  If compulsory education is blank cours may not have it, se curriculum for information about this.

• Tuition fee

  A semester fee is required.

  An external student is defines as a student from another Nordic coutry, or an agency outside the police service (including police special agencies). The tuition fee is not applicable to students coming from insttitutions which have a reciprocal agreement with NPUC, or an agreement involving contributions to the study programme. The student fee is NOK 15 000,-.

• Contact information

  Academic questions

  Academic inquiries should be adressed to e-mail: cybercrime@phs.no.

  Questions relating to the admissions procedure

  Questions regarding the admission process (deadline, application process, documentation) should be adressed to e-mail: opptakevu@phs.no.

  Administrative questions about the study programme

  If you do not find what you are looking for, please send an email to: studiekontoret.oslo@phs.no

The course is one of a series of modules in the NCFI Program

• All modules

  Nordic Computer Forensic Investigators - Module 0 Introduction to Digital Policing (Digital Forensics)

  Nordic Computer Forensic Investigators - Module 1 Core Concepts in Digital Investigation and Forensics

  Nordic Computer Forensic Investigators - Module 2A Computer Forensics

  Nordic Computer Forensic Investigators - Module 2B Online Investigation

  Nordic Computer Forensic Investigators - Module 2C Network Forensics and Cybercrime

  Nordic Computer Forensic Investigators - Module 2D Mobile Extraction and Artifacts

  Nordic Computer Forensic Investigators - Module 3A Forensic Tool Development

  Nordic Computer Forensic Investigators - Module 3B Linux Forensics

  Nordic Computer Forensic Investigators - Module 3C Linux as an Investigative Platform

  Nordic Computer Forensic Investigators - Module 3D Macintosh Computer Forensics

  Nordic Computer Forensic Investigators - Module 3E Windows Forensics

  Nordic Computer Forensic Investigators - Module 3F Memory Investigation

  Nordic Computer Forensic Investigatiors - Module 3H Mobile Forensics II

  Nordic Computer Forensic Investigatiors - Module 3J Malware Investigation

  Nordic Computer Forensic Investigators - Module 3K Digital Investigation

  Nordic Computer Forensic Investigatiors - Module 3L Database Investigation and Data Mining

  Nordic Computer Forensic Investigatiors - Module 3M Forensic Tool Development II

  Nordic Computer Forensic Investigatiors - Module 3N Crypto Assets

  Nordic Computer Forensic Investigatiors - Module 3R R, Visualisation & Descriptive Statistics