With students completing their University applications (the deadline is 15th January 2009, for a 2009 entry), more and more students are research courses in computer forensics courses.
If after reading this article, and looking at the university rankings and the courses available, a prospective student is still looking for computer forensics course at a university, what should they look for in a course?
How to try and identify the better courses:
Maturity of the course: Generally speaking the longer the course has been ran, the better it will be. Problems will have been ironed out, the course will have developed
Investment: Does the course have its own forensics lab, or do they share it with other computer departments? Can you see it before you apply? What equipment and software do they have? Is it the standard 10 copies of Encase (its a bundle that Guidance sell, very cheaply, to Universities), or have they got more?
Industry Experience: How much industry experience do the course leaders have? Have they ever worked in the industry, have they been part of the private sector, or is their work just theory?
Who Attends? What sort of people go on this course? Is it just 18-21 years olds with no industry experience? If so the course will be tailored to their needs. Are they a lot of police officers attending (part time), if so the course will have police leanings? Is the course backed by any of the big forensic companies?
Data Recovery: Is data recovery covered? Ask questions about the tools used, if the answer is “FTK and EnCase” then they are not teaching detailed data recovery.
E-Discovery: Is this multi-billion dollar subject covered? How much, and in what detail? Are the issues of tapes, review platforms, clustering, or the like covered?
Forensics: What subjects are they focusing on? Is it data theft, fraud, and the major cases, or is it child pornography?