Registry Analysis Workshop

Description

Forensic investigation often requires understanding whether a particular computer system has been used to commit an offence. This workshop provides students with the necessary skills to forensically analyse registry database files within the Microsoft Windows operating system. Students use hands-on exercises to interpret registry key values – whether they are deliberate actions of a computer user or form part of automated computer processes. This workshop is open to full-time computer forensic personnel with basic computer forensic training and work experience in the extraction and interpretation of digital evidence.

Format and delivery

Length of course

4 days

Class size

maximum 20 students

Delivery setting

computer classroom

Learning outcomes

• Understanding the purpose and value of registry files.
• Ability to use different techniques to locate and verify registry data content.
• Ability to extract and interpret registry file information on running computer systems.
• Ability to conduct a preliminary on-scene live examination of registry files.
• Understanding how to interpret registry data that explains the presence of externally connected devices.
• Ability to extract and interpret information/evidence from older backup copies of registry files.
• Knowledge of software programs frequently used.

Eligibility and mandatory requirements

• Registrants must have completed the Computer Forensic Examiner (CMPFOR) course.
• Acceptance or refusal in the course is at the discretion of the Canadian Police College.

Assessment

• Success in the course is based on participation and completion of all required assignments.

Contact

For more details or other information about the course, please email cpc_registrar-registraire_ccp@rcmp-grc.gc.ca.

Date modified:

2024-02-09