Participants are strongly recommended to have at least advanced user experience of at least one current Microsoft Operating system and, optionally, a Unix based operating system (Linux, BSD, etc..). Basic familiarity with several Internet enabled applications, including but not limited to, web browsers, telnet, ftp, email, chat, or internet messaging software is very helpful. Additionally, prior investigation experience in any discipline, having advanced UNIX skills, familiarity with basic technologies on the Internet - such as newsgroups, search engines, guest-books and message boards - are also helpful.

The course is open to law enforcement and computer crime investigators via the Internet meeting basic requirements.

Participants may work within the course track or additionally opt for fullfilling requirements that will lead to certification at the level of the course material.

As a result of the course, it is expected that participants will

• Understand the origins, structure, topology and fundamental components of the Internet
• Have a basic understanding of the structure and purpose of some major protocols used on the Internet
• Know how and why to set up anonymous and covert identities/websites for purposes of investigation
• Understand how many Internet-enabled applications communicate across the Internet
• Be able to thoroughly examine raw web page and basic Email header content
• Determine approximate identities and geographic locations of websites and user accounts on the Internet
• Know how to overcome some typical obstacles to getting a user's IP address
• Know how to utilize generally and readily available applications for purposes of investigating online suspects
• Understand the methods, resources, and tactics taken by the common hacker
• Understand the basic tactics and strategies of cyber-terrorism attacks

On-line information, articles, distributed learning tools, and supplementary readings will be provided by the instructors. Reading assignments and tool information will be periodically updated on the course website.

Active participation is required for maximum learning. Participants are expected to carefully read all assigned reading material, thoroughly complete all assignments and skill exercises. Additionally, certification candidates are to provide thorough documentation of all computer and Internet investigations they have participated in. This includes but is not limited to investigations that were initiated via the Cybersnitch Reporting System. Participants are also strongly encouraged to work with other online participants to work out problems, discuss scenarios and issues, and other training related matters.

Participation in on-line meetings is optional unless an instructor specifically states otherwise. Participants are free to request a meeting for themselves or for all members. Participants are free and encouraged to interact with instructors using available training tools, including but not limited to Email, chat, and multimedia solutions.

Announcement for meetings will typically be done via Email or via the CERI Member System. Meetings will generally be announced 24 hours in advance. Online meeting time will be used for purposes of training, question and answer sessions, demonstrations, and discussions.

This course will utilize a combination of reference material, skill exercises using online tools, possible multimedia interaction including presentations, real-world investigation exercises, online tours, message-bases, Email, and Internet relay chat for communication and discussions.

This course will focus on the Windows platform, as well as Microsoft based Internet technologies, for examples and demonstrations.

Each participant is expected to accrue enough points to merit successful completion of the course. Points may be obtained through all the following:

• The completion of tasks deemed "Assignments"

Additionally, Certification candidates will be expected to accrue enough points to merit certification. Points may be obtained through all the following:

• The completion of tasks deemed "Assignments"
• The investigation and submission of well documented investigation reports
• Passing of a comprehensive "examination"

Certification eligibility for each participant will be determined based on the total number of points obtained through the training program.

All tasks, skill exercises, exams, quizzes, and other projects and assignments will be evaluated based on a pass/incomplete criterion.

Assignments need to not only be completed successfully, but accurately, and at the level of the course material.

Investigation reports need to be thoroughly documented, covering the report incident from start to finish, including insights and descriptions of methodologies used, technology used, interviews with victims, witnesses, etc.. To help facilitate the accurate creation of reports, forms have been created and made available on the course menu.

Upon receipt of an incomplete of any Assignment or report submission, the participant will be allowed to ask questions, request advice, and make corrections. Participants then will be given the opportunity for resubmission. This will be allowed for up to (3) three reviews in total per submission item.

During the entire course, participants may inquire and discuss all challenges with the instructors and virtual classmates using the communication media afforded through the training program. The only time this convenience will not be available to the participant is during the final exam and final skill exercises. The final exam will be, however, "open net", meaning the participant can use the Internet to assist in the taking of the exam. Obtaining assistance from anyone either in the training program or outside the training program, during a final exam or final skill exercise, i.e.. "cheating", will result in the participant being ineligible to receive certification, and fees paid will not be refunded.

Module 1 : Introduction to Online Investigation
Module 2 : The Internet: the beginning, history, establishment of the Internet
Module 3 : What is TCP?: understanding the basics of communication on the Internet
Module 4 : Servers and more: a look at the basic functionality of the Internet
Module 5 : Internet Apps: overview of the commonly used Internet applications (Email)
Module 6 : Internet Apps: overview of the commonly used Internet applications (FTP)
Module 7 : Internet Apps: overview of the commonly used Internet applications (Browser)
Module 8 : Internet Apps: overview of the commonly used Internet applications (Chat Technology)
Module 9 : Investigation 1: The investigator's toolbox
Module 10: Investigation 2: fundamental investigation techniques (WWW)
Module 11: Investigation 3: fundamental investigation techniques (Email)
Module 12: Investigation 4: fundamental investigation techniques (Chat Technology)
Module 13: Investigation 5: fundamental investigation techniques (search and trace)
Module 14: The traditional threat: Social crimes go high-tech
Module 15: The online threat: Black Hat Motus Operandi, tools, resources
Module 16: The online threat: BHs and SKs treat the Internet like a personal playground
Module 17: Final exam (certification students)

Participation is contingent upon acceptance of CERI Training Programs - Terms and Conditions.