CSI: NECC—Computer Forensics and Data Recovery for Educators

Executive Summary
One of the best seminars I've attended in a long time! The two hour session demonstrated tips, tricks and techniques for performing a forensic search on computer hard drives. The first half of the session was an overview of what to consider before initiating a forensic search. The second half included a brief hands on exercise of safely duplicating a suspect hard drive and then using tools to perform analysis on the contents of the hard drive at various levels (byte level, sector level, directory/file level). The presenter discussed and demonstrated various software tools (booth freeware versions and fully licensed) for use in a forensic search of a hard drive.
While the presenter didn't discuss it, it may be possible to use the demonstrated tools to perform data recovery from hard drives that are going bad.

One of the most significant things I took away from the session was a greater appreciation to carefully assess any situation requiring forensic analysis. If the situation could culminate in legal action, careful documentation and a very structured process must be followed.

See the presenter's home page for the power point slideshow that includes references to the software tools and useful websites. If you're a true tech geek, be sure to try out the utilities mentioned in the presenter's slide show, they'll be good to have in your toolbox.

Presenter
Brent Williams, Kennesaw State University

For anyone attending NECC, the presenter is doing a session about wireless networks on Wednesday June 27th from 12:00-01:00 .
"What's Wrong with WiFi in Schools? 10 Common Mistakes" Location=GWCC B217
If this session is half as good as his other seminar, I would suggest it for tech support people.

Presenters homepage:
http://www.speakwisdom.com/

Presenter's NECC slideshow on computer forensics:
http://www.speakwisdom.com/brentdocs/CSI%20NECC%20Introduction%20to%20Forensics.ppt

Presenter's other slideshows:
http://www.speakwisdom.com/Presentations.htm