Greetings HTCIA Members,

Just a reminder of tonight's HTCIA Ontario Chapter Meeting at the Toronto Police College, 70 Birmingham Street, Toronto, Ontario.

In order to give our members the latest and greatest up-to-date information, we have made a change in tonight's agenda in order to bring you AccessData's FTK 4 !!!

We are pleased to announce that Mr. Troy Clark, account executive from AccessData, responsible for Canadian sales, will be giving an overview of the new features in FTK 4 (with visualization and Cerberus for malware analysis).

Also speaking will be Dr. Scott Graham on "How to Succeed in the Business of Detecting Data Exfiltration by Copying without Really Having Any Apparent Artifacts to Work With."

HTCIA is more than just a professional association; it's an opportunity for you to connect with other investigators, receive training, and get answers that you might not otherwise have access to. In fact, any chance you have to expand your network -- whether locally or nationally or internationally via any of our channels -- is a chance to improve your investigative knowledge, skills and abilities.

So come on out and enjoy what should be a great and rewarding meeting for all !

Sincerely,

2012 HTCIA Ontario Chapter Executive Committee

Ben Whittaker -- President
G. Scott Graham -- 1st VP
Matthew Ross -- 2nd VP
Eugene Silva -- Secretary
Neal Greenberg -- Treasurer

Link to map:

http://goo.gl/z1ext

For the first time, the Canadian Police College, Technological Crime Learning Institute in Ottawa is offering one of our computer forensic courses to the private sector.  It is normally only for the law enforcement.  This event is a 4 day Live Analysis workshop for extracting items of evidence from RAM.

"NEW for this Workshop ONLY: Any person in the private sector that is working closely with law enforcement may attend this workshop. Please send your registration form before December 10th, 2011.

Canadian Police College: Live Analysis Workshop

Details

This four-day workshop is designed for technological crime investigators who may be required to seize and / or analyze system information or memory contents from live computers. It looks at memory structures along with the different types of system information available on live computers.

It also addresses the proper methodology and techniques for seizing memory and system information from live computers. Techniques for extracting images, passwords, chat logs, documents, and other artefacts from volatile data will also be covered as will the basic interpretation and analysis of live system information.

The focus of the workshop is to give the investigator confidence in seizing volatile data from live computer systems, and to give the investigator the necessary skills to perform a basic analysis of the seized data.

Theme:

• Windows memory architecture basics
• Methodological concerns
• Tools and techniques for acquiring computer memory
• Tools and techniques for searching and recovering artefacts from memory
• Tools and techniques for acquiring system information
• Interpretation and possible responses to system information

Eligibility:

• To be eligible to register in the Live Analysis workshop at the Canadian Police College (CPC), a potential participant must be either:
• an employee of a Canadian or an international police service
• an employee with Peace Officer status from a Canadian government agency (federal, provincial or municipal)
• an employee who has an investigative mandate within an agency from the public or private sector

Technical knowledge criteria:

Individuals must have successfully completed a course of training in computer forensic analysis (e.g. EnCase, CMPFOR, etc.).

Tuition:

• Canadian Police: $500
• Canadian Agencies / Private Sector: $700
• International: $900

Location:

January 24-27, 2012. 8am to 4pm. (Four days)
Canadian Police College
1 Sandridge Road
Ottawa

Contact Information: CPC Registrar – 613-993-6033 or This e-mail address is being protected from spambots. You need JavaScript enabled to view it .

Registration information and forms are available at: http://www.cpc.gc.ca/en/registration

"