Conducting Live Investigations with US-LATT™   $250.00     Extracting and examining live volatile evidence from running computers is becoming vital due to the size, reach and mobility of laptop, desktop and server environments. The amount of evidence that can be lost in pull-the-plug only investigations is alarming. This hands-on lab session will give participants the opportunity to use the latest Live Acquisition and Triage Tool (US-LATT). US-LATT was developed by WetStone under National Institute of Justice grants.   Students that are U.S. State, Local, Federal and retired law enforcement attending the class will receive a 4GB US-LATT device with maintenance for 1 year. Others not meeting this criterion will be  able to (optionally) purchase the technology for a small fee. Student must bring their own laptop with windows XP or above, to participate in the lab exercise. Participants that desire to become US-LATT Certified may choose to take a certification exam at no charge.

Conducting Peer to Peer (P2P) Investigations   $250.00     P2P focused investigations give investigators instant access to timely and relevant evidence and information that may assist in clearing a case and provide needed information regarding coconspirators, victims and other criminal or civil activity. This hands-on lab session will educate participants on the dangers of P2P applications along with the rich set of evidence they can reveal. Participants will be shown how to extract vital investigative information from a number of widely used P2P applications using manually and automated tools. In addition, participants will be given a challenge lab problem to test their skills.   Participants must bring their own laptop with windows XP or above, if they wish to participate in the hands on lab exercise.

Discovery of Malicious Code Evidence   $250.00     Today’s advanced computing environments with terabyte and beyond media require new approaches to rapidly and accurately identify the presence of malicious code. Beyond viruses and worms the threat of botnets, keyloggers, anti-forensic wireless hacking tools, rootkits, steganography and other threats is essential knowledge for the investigator. Knowing what is installed and in use by the adversary can help prove intent, cognizance of guilt and a better overall picture of the situation. During this hands-on lab session class participants will be exposed to the advanced malware technologies being utilized by today’s cyber criminals. During the lab session participants will utilize WetStone’s award winning malware discovery software, Gargoyle Investigator™, to detect and analyze the presence of malware found during a mock investigation.    Participants must bring their own laptop with windows XP or above, if they wish to participate in the lab exercise. Participants that desire to become Gargoyle Investigator Certified may choose to take a certification exam at no charge.

Trait Analytics Profiling Search (T.A.P.S.) Investigations      (This lab is open to U.S. State & Local Law Enforcement Only)   FREE     As criminals communicate and conceal vital information in new ways, it is urgent that trained experts exist to counter this threat. A deep understanding and analysis of images, multimedia files and network protocols along with clear understanding of the known methods of data hiding are essential in order to participate in this analysis. This hands-on lab session will give participants the opportunity to use the latest Trait Analytic Profiling Search (T.A.P.S.) technology. T.A.P.S. provides direct media scanning (with write blocker), DD or Raw Image Mounting and scanning and supports scanning inside archives.  Detailed reporting and time lining of results are also included.    Since the T.A.P.S. core research was funded by NIJ, the software is available FREE to U.S. State and Local Law Enforcement.  This lab will be open to U.S. State & Local law enforcement ONLY, and students attending the class will receive the T.A.P.S. Technology for free with maintenance for 1 year.

June 2, 2011

8:00 - 11:00
Discovery of Malicious Code Evidence

1:00 - 4:00
Conducting Live Investigations

4:00 - 5:00                             Exam

June 3, 2011

8:00 - 11:00
Conducting Live Investigations

11:00 - 12:00
Exam

1:00 - 4:00
Trait Analytics Profiling Search (T.A.P.S.) Investigations

June 4, 2011

8:00 - 11:00                   Conducting Live Investigations

11:00 - 12:00
Exam

1:00 - 4:00
Conducting Peer to Peer (P2P) Investigations