Internet Evidence Analysis
Course details
2026
| Session(s) | Location | Start date | End date |
|---|---|---|---|
| 26-01 English | Ottawa | 2026-01-19 | 2026-01-30 |
| 26-02 English | Ottawa | 2026-05-04 | 2026-05-15 |
| 26-03 English | Ottawa | 2026-10-19 | 2026-10-30 |
| Tuition |
|---|
| $5,500.00 |
Notes
- Accommodations are offered to course participants. Our rooms are subject to availability and the request must be indicated on the course registration form
- Meal plans are offered to course participants. The specific meal plan must be indicated on the course registration form
- Travel grant funding is available to our non-federal law enforcement agencies
Description
The course provides the knowledge and skills to conduct a forensic examination on computer systems for Internet artifact evidence created by various software applications primarily on a Microsoft Windows operating systems. Artifact evidence from these may include settings, log files, and files created through application use. The course explores the most widely used applications, including web browsers, peer-to-peer file sharing, messaging platforms and webmail, as well as common data storage such as SQlite and LevelDB databases, JSON and others. Participants then learn how to apply these skills to new applications or application versions where commonly used digital forensic tools may be less effective, or where a deeper exploration of artifact evidence is required. The course emphasizes a research-driven methodology for uncovering less easily accessible evidence.
Format and delivery
- Length of course
- 10 days
- Class size
- Maximum 20 participants
- Delivery setting
- Combination of a computer classroom and a computer laboratory
Learning outcomes
- Describe how common Internet communication protocols work and provide examples of what content they carry
- Analyse digital evidence artifacts created by web browsers
- Locate digital evidence artifacts created by popular instant messaging clients
- Extract and format data from SQLite databases with the use of complex queries
- Collect digital evidence artifacts created by peer-to-peer clients running on a Microsoft Windows operating system
- Extract available digital evidence stored in computer system memory
- Apply approaches for analyzing digital evidence data when commercial application support is not available
Eligibility and mandatory requirements
- This course is offered to law enforcement officers and civilian computer forensic analysts who:
- are working in a technological crime investigative unit or program, and
- have basic skills in the use of a current commercial forensic application
- Registrants must have completed the Computer Forensic Examiner Course (CMPFOR). Alternatively, consideration can be given to experienced computer forensic examiners, preferably with two years of experience, at the discretion of the lead instructor
- Acceptance or refusal in the course is at the discretion of the Canadian Police College
Assessment
- Success in the course is based on attendance, participation and successful completion of all required assignments and learning evaluations
- Various evaluation methods are used, including a written exam with practical exercises and a final group project
- Re-testing or re-evaluation is conducted in accordance with the CPC Academic Directives and at the discretion of the Canadian Police College
Contact
For more details or other information about the course, please email cpc_registrar-registraire_ccp@rcmp-grc.gc.ca.
- Date modified: