Bio: Robert Urquart
Introduction
After graduating from the Australian Air Force as a Radio Electronics Technician, Robert Urquhart became involved in the computer industry when the word computer generally referred to a whole room filled with sophisticated electronic equipment and has remained continuously involved with computer hardware and software since that date to this point in time where he is now engaged as a Digital Forensics practitioner.
His extensive experience and qualifications in computer hardware and I.T.-related equipment provide him with a unique ability at the grass-roots level of acquiring data from a digital storage device. His 24 years’ experience in the computer industry have allowed him to gain experience in many technologies and consequently be able to handle many of the challenges faced in forensically acquiring and examining information from digital storage systems.
Being entrepreneurial in the field Robert has taken many steps towards building his expertise so that he could be well equipped to face the expediential growth of need for digital forensics. He is constantly undergoing training and in 2012 spent 8 weeks in the classroom.
Like any serious Technician, Robert has obtained qualifications along the way to his forensic pathway and is constantly attending skills courses to keep him at the leading edge of developments in the forensics and information technology spheres. Last year he undertook 8 weeks of training. Further education is of great importance in keeping abreast of the seemingly ever increasing production of new electronic technologies, and the methods being utilised by the unscrupulous to steal your most important assets and even your identity.
Thorough, qualified forensic evidence collection is the only tool that will convince a court and Robert has already been involved in matters where his evidence has been pivotal on police being able to lay charges against those responsible.
Robert’s expert opinion is a valuable tool in identifying those responsible, their prosecution and recovery of damages and costs.
On-going Professional Development
The personal responsibility of any serious professional working within the area of digital forensics is to increase their knowledge of the subject areas they are involved with.
As an indication of the large amount of training we undertake, in 2012 Mr Urquhart undertook in excess of 350 hours, around 2 months of study. This study was through local universities and SANS training in Florida USA. This is in depth Masters-level courses.
Training is also progressed periodically by attending conferences and technical workshops, conducting independent research, participating in online specialist forums and by discussions with subject matter experts.
Certifications/Qualifications
Encase Certified Examiner (EnCE). Guidance Software
Graduate Certificate in Information Systems Security Charles Sturt University.
Post Graduate Certificate in Electronics N.S.W. TAFE
Radio Trades Certificate Commonwealth of Australia
Radio Electronics Technician R.A.A.F.
Certified Ethical Hacker (CEH) EC Council
Certified Forensic Hacking Investigator (CHFI) EC Council
Bachelor in Creative Arts (Music) Wesley Institute
An s177 certificate is available on request as is a full Curriculum Vitae.
Memberships & Associations
Forensic Expert Witness Association.
International High Tech Crime Investigation Association
Australian Information Security Association
Training & Experience
Masters in Information Systems Security (undertaking)
Graduate Certificate in Information Systems Security Charles Sturt University
Digital Forensics stream subjects:
Digital Forensics, Forensic Investigation, Hacking Countermeasures, Network Security
Encase Computer Forensics I training Dimension Data
Encase Computer Forensics II training Dimension Data
Certified Computer Examiner (CCE) Boot Camp Australian Forensic Services
X-Ways Forensic training Australian Forensic Services
Mobile Device Forensics training (XRY-Cellebrite) SANS
File Systems Revealed training Australian Forensic Services
Microsoft Certified Systems Engineer training Emerald IT
Apple Macintosh Service training Apple Australia
IBM Advanced Function Dealer PC Service training IBM Australia
IBM Personal Computer Warranty Service training IBM Australia
Worked continuously for 4 years, on over 150 digital forensic examinations
Worked continuously for 25 years repairing and servicing I.T. equipment (IBM compatible, Apple)
Extensive experience and proficiency in repairs and service of computers, networks and peripheral devices.
Training Course Detail
The EnCase Certified Examiner (EnCE) program certifies both public and private sector professionals in the use of Guidance Software's EnCase computer forensic software. EnCE certification acknowledges that professionals have mastered computer investigation methodology as well as the use of EnCase software during complex computer examinations. Recognized by both the law enforcement and corporate communities as a symbol of in-depth computer forensics knowledge, EnCE certification illustrates that an investigator is a skilled computer examiner.
Excerpts from: http://www.guidancesoftware.com/computer-forensics-training-ence-certification.htm
Encase Computer Forensics I training
This 4 day hands-on face to face course involves practical exercises and real-life simulations in the use of EnCase Forensic. The class provides participants with an understanding of the proper handling of digital evidence from the initial seizure of the computer/media to acquisition. Instruction then progresses to the analysis of the data. It concludes with archiving and validating the data.
Excerpts from: http://www.guidancesoftware.com/computer-forensics-training-encase1.htm
Encase Computer Forensics II training
This 4 day hands-on face to face course is designed for investigators with strong computer skills, prior computer forensics training, and experience using the EnCase Forensic. This course builds upon the skills covered in the EnCase Computer Forensics I course and enhances the examiner's ability to work efficiently through the use of the unique features of EnCase. Students must understand evidence handling, the structure of the evidence file, creating and using case files, and data acquisition methods, including DOS-based, hardware write protected, crossover cable, and disk-to-disk. It is also important that the students are familiar with the methods for recovering deleted files and folders in a FAT environment, conducting keyword searches across logical and physical media, creating and using EnCase bookmarks, file signatures and signature analysis, and locating and understanding Windows artefacts.
Excerpts from: http://www.guidancesoftware.com/computer-forensics-training-encase2.htm
Graduate Certificate in Information Systems Security
The aim of this course is to provide professionals in the IT industry with an advanced course of study in designing, planning, and implementing enterprise level security as part of a secure computing environment and integrates industry certification in these fields.
This study was undertaken as a 4-subject course over 4 semesters. Subjects included Digital Forensics, Forensic Investigation, Hacking Countermeasures and Network Security.
Certified Computer Examiner (CCE) Boot Camp
This one week hands-on face to face course is designed for investigators with strong computer skills, prior computer forensics training
The CCE Boot Camp is an intensive one week classroom and laboratory training course in computer forensic examinations. This course will teaches how to conduct forensically sound computer examinations, with preparation for taking the CCE certification test.
Mobile Device Forensics
This 5 day intensive hands-on course covers a lot of ground, including CDMA and GSM cell phones, Blackberry, Windows Mobile and iPhone. A comprehensive methodology for processing mobile devices as sources of evidence is emphasized throughout the course, and the hands-on exercises utilize a mix of free and commercial tools, including Cellebrite, XRY and XACT.
File Systems Revealed
This 2 day instructor-led course is an extensive hands-on introduction to the file systems FAT12, FAT16, FAT32, NTFS, and Ext2/Ext3.
R.A.A.F. Radio Electronics Technician
The military employment commenced with a 18 month full time course in radio-electronics. This was followed by 3.5 years employment working in this field.
X-Ways Forensics
This 3 day instructor-led course is focused on the systematic and efficient examination of computer media using the integrated computer forensics software X-Ways Forensics.
Forensic Software Descriptions
Encase Forensic
Guidance Software is one of the leading vendors of forensic software and hardware tools in the world. It is the most accepted analysis tool in courts, and one of several of a pallet of tools carried by any examiner. The software together with hardware devices, allows the imaging of hard drives, mobile phones, flash memory and other devices. With this software analysis can then be performed to process the acquired device image and recover many different kinds of information about the acquired media. It is an extremely powerful tool drawing together many other tools into one, enabling the examiner to efficiently work.
X-Ways Forensic
Designed and supported by X-Ways Software Technology AG X-Ways Forensic is another powerful forensic examination software tool. In conjunction with various hardware write blocker devices, the most complex acquisition and analysis can be performed. Another tool for the forensic examiners kit, this high caliber software incorporates many functions allowing the searching, recovery, analysis and interpretation of data contained on a device under examination.
