|
Exhibit 2
CV of H. William Nelson
H. William Nelson
Law Office of Christopher K. Steuart
11206 Des Moines Memorial Drive S., Suite 104
Seattle, Washington 98168
Cell Phone: 206-683-3812
/ Web: www.steuartlaw.com
Employment History
Employer: Law Office of Christopher K. Steuart— (part-time, concurrent with Boeing employment)
Job Title: Computing Forensic Examiner & Curriculum Developer (November 1999 to Present)
Duties: Develop lesson plans on computing investigation methods for large corporate network enterprises. Conduct training workshops for IT professionals in computing investigation processes. Organize, negotiate, and manage advance computing security, computing vulnerability assessment, and network intrusion response training programs for corporate IT professionals. Provide consultation to IT professionals, law enforcement investigators on computing investigation technical issues. Significant Accomplishments: Developed hands-on computing security-investigations training for a major Telecommunications Company that was over one hundred instructional hours in length. Coordinated and contributed training in the following areas: high tech affidavits, high tech curriculum vitae, computing investigation processes, computer forensics, UNIX investigation processes, Windows 2000 investigation processes, and Internet/Intranet investigation processes. Delivered a three-day course to Washington State Community College instructors on Computing Investigations and Forensics processes through Spokane Falls Community College. Provided consultation, forensics examination, and directed other examiners for the defense in United States v. Sami Omar Al-Hussayen. Provided expert witness testimony for defense counsel in criminal case State of Washington v. Bajwa, Snohomish Superior Court, Everett, Washington November 2007.
Employer: The Boeing Company, Bellevue, WA
Job Title: Senior Enterprise Information Security Assessments (October 2008 to Present)
Duties: Conduct vulnerability and risk analysis of Web applications using open source and commercial testing tools. Evaluates computing and information security risk and develops response plans for Web application security. Develops, tests and implements security solutions and procedures to ensure that systems are compliant with applicable policies, procedures, contracts and regulatory requirements. Provides consultation and advice on computing security issues. Develops and apply secure systems architecture and design methods, processes, tools, and techniques to ensure compliance with security requirements. Direct, conduct and mitigate comprehensive complex risk assessments and investigations. Provide leadership and mediation for compliance issues and solutions. Acts as industry expert in investigative technologies and processes. Conducts research and develops advanced concepts and techniques. Directs the development of training materials and enterprise wide processes. Provides compliance and audit support.
Employer: University of Washington (part-time, concurrent with Boeing employment) Job Title: Part-time instructor (May through June annually, 2004 to Present)
Duties: Co-instructor for the Certificate Program in Computer Forensics at the University of Washington’s Extension program. Instructions provided are in advance computer forensics for the third college quarter classes in the Seattle, Washington Outreach campus, see www.outreach.washington.edu/ext/certificates/cpf/cpf_gen.asp.
Employer: The Boeing Company, Bellevue, WA
Job Title: Senior Enterprise Computing Investigations (January 1998 to 2008)
Duties: Responsible for implementation of computing investigation processes for The Boeing Company. Responsibilities were to provide lead technical support in computer forensics other computing forensics examiners in The Boeing Company. Provide support to twelve examiners domestically and two examiners
internationally that serve the Boeing enterprise network worldwide. Develop training for coworkers assigned to computing investigations world-wide. Develop and implement standard practices for conducting computing investigations and data recovery for discovery for Company’s computing enterprise. Provide introductory computing investigations and forensic analysis overviews for non-technical investigators, paralegals, and lawyers. Develop testing and validation processes of new computer forensic tools for distribution throughout the company's security investigation program. Provide consultation on best practices for computing technology investigations needs to the company's Office of General Counsel's chief litigation attorney. Provide consultation the General Counsel and outside Law Firms on computing data that is determined to be International Traffic of Arms Regulation (ITAR—US Dept. of State), Export Administration Regulations (EAR—US Dept. of Commerce), company Intellectual Property sensitive. Initiate and assign personnel to computing investigation tasks. Perform detailed analysis of computer disk drives for collecting evidence for litigation. Perform project manage for e-discovery responses for the company’s law department and outside counsel. Coordinate with information technology staff, company lawyers, paralegals, and outside counsel for litigation responses.
Significant Accomplishments: Created a Boeing internal training program on computer forensics for non- computing literate security investigators. Documented computing investigation processes and authored manuals for distribution to company security investigators. Developed a process to assure proper retention of computing evidence for all casework. Supervised several investigations that resulted in significant cost saving from lawsuits. Created and deployed company-wide computing investigations manual for security investigators and Boeing Law Department. Created a process investigation method on how to best deal with PDA devices. This PDA investigation guide has been adopted by King County, (Seattle) Washington, Sheriff's Office—Fraud and High-Tech Crime unit as their standard for investigations involving PDAs. Designed a protocol for managing criminal investigations in the corporate environment. Project managed several discovery response to litigation for Boeing on several significant cases. Routinely provide consultation on advance computing and investigation methods to other Fortune 500 companies, city, county, state, and federal law enforcement agencies. Hosted six X-Ways Forensics training sessions for Boeing computing security personnel and non-Boeing computing forensics examiners.
Employer: Lightpoint Learning Solutions, Bellevue, WA (Part-time position)
Job Title: Lead Instructor/part-time position (September 1999 to June 2000)
Duties: Developed and managed two (for college credit) courses through City University, Renton, Washington in computer investigations and computer forensics. Created lesson plans and directed other instructors in class preparation and instructional delivery to students. Recruited other computer forensics specialist for instructor positions.
Significant Accomplishments: Delivered the first college courses in computer investigation and computer forensics for the Puget Sound region. Successfully encouraged the majority of students to pursue a career in computing investigations and computer forensics.
Employer: The Boeing Company, Renton, WA
Job Title: Computing Security Specialist, Investigations (November 1996 to 1998)
Duties: Conduct investigations on computing and communications infractions for the Boeing Company. Analyze, plan, and implemented improved high technology investigation methods. Provided training and guidance on proper computing security investigations procedures. Document investigation procedures. Process computing infractions, maintained custody of evidence for civil and criminal disposition. Provided high technology investigation consultation to company management.
Significant Accomplishments: Successfully identified an employee who was stalking another employee through an anonymous email. Successfully found evidence identifying an employee who had posted inappropriate messages of his female manager on a Gay/Bisexual Bulletin Board Service. Provided assistance in a rape case investigation, identified additional victims through examination of suspect company email messages. Provided assists in video surveillance systems for investigations. Set up remote monitoringCV-H.W.Nelson, Version of May 19, 2009 Page 2 of 14
over company network of desktop computers used by suspects violating company rules and policies. Created an investigation plan for a child pornography investigation conducted by the U.S. Customs Service. Secured evidence-identified witnesses, suspect, and additional resources for a child pornography case inside the company, filed complaint with the Tukwila Police, Tukwila, WA. Provided expert testimony for depositions and employment hearings.
Employer: NEC Technologies, Inc., Bellevue, WA
Job Title: AFIS Software Engineer (1990-1996)
Duties: Provide assistance and direction to Police agencies in criminal investigations utilizing an Automated Fingerprint Identification System. Provided systems analysis for Police Departments Identification bureaus automation needs. Design and wrote user guides and training courses that promote customer product usage. Prepared detailed system design documents for computer system sales and delivery. Experience in project planning, project management, and systems integration.
Significant Accomplishments: Created quality documents that reduced Software Engineering travel requirements by 50%. Improved training of field technical personnel. Designed project management training documentation for company-wide implementation (NEC is a Fortune 500 company). Established a lean process of documenting new and upgraded AFIS systems that provided significant reductions in product deliveries. This improved lean process resulted in the lowest amounts of errors during acceptance testing with the Calgary, Alberta Police Service AFIS and the Washington State Patrol AFIS.
Employer: The Boeing Company, Kent, WA
Job Title: VAX & Apollo System Manager - SRAM II (1988-1990)
Duties: Managed daily operations of a software production facility. Provided guidance to programmers on utilizing computers and vendor documentation. Maintained both facility and computer security of a TEMPEST Software Development Laboratory. Provided systems integration and testing for non-standard hardware and software applications.
Significant Accomplishments: Received commendation for outstanding performance during a Defense Investigative Service computer security audit. Improved productivity of operations, cutting manpower needs by half through better planning and managing of tasks and resources.
Employer: The Boeing Company, Kent, WA
Job Title: Data Security Administrator - Peace Shield (1986-1988)
Duties: Wrote Security documents and procedure guidelines for a U.S. Defense contract program. Coordinated updates for company computing security manuals. Schooled computer users on security procedures. Integrated computing security processes as standard operations practices.
Significant Accomplishments: Improved computing security process flows and implemented a security report generator for classified output. Managed implementation of software utilities to track classified controlled printouts for defense contract.
Employer: The Boeing Company, Kent, WA
Job Title: VAX Computer Operator - C-SAFE (1984-1986)
Duties: Contributed to the development of security software for a "System High" facility. Assisted in site operations for a research analysis group. Trained users on systems and applications functions and usage of hardware and software used in a software development lab environment. Maintained records for daily operations and security needs. Performed routine inspections of physical security of computer laboratory facility.
Significant Accomplishments: Assisted in programming software for automated security procedures. Created software to improve daily operations of the computer laboratory facility.
Employer: Photo & Sound, Seattle, WA
Job Title: Media Technician (1982-1984)
Duties: Provided audio-visual technical support to hotels and conferences. Provided consultation how how to apply media equipment for customers.
Employer: Highline School District, Seattle, WA
Job Title: Investigator (1977-1980)
Duties: Investigated all security and safety incidents. Investigations ranged from safety violations and accidents to thefts, burglaries, and fatal accidents. Supervised security personnel. Conducted interviews of witnesses, school employees, and students on all investigative matters. Performed surveillance tasks on high- risk facilities.
Significant Accomplishments: Successfully investigated two fatal traffic accidents involving school district vehicles. Conducted successful interviews and interrogations of students suspected of drug usage and dealing.
Employer: Puyallup School District, Puyallup, WA
Job Title: Media Technician (1976-1977)
Duties: Maintained instructional media inventory for entire school district. Supervised student assigned to support distribution of instructional media materials.
Employer: Fort Steilacoom Community College, WA
Job Title: Audio-Visual Technician (1974-1976)
Duties: Managed distribution of instructional resources ranging from audio-visual equipment and instructional media. Supervised part-time student employees in the delivery to classrooms instructional media.
Testimony Experience
State of Washington v. Bajwa, Snohomish Superior Court, Everett, Washington November 2007. Provided expert witness testimony for defense counsel.
Affiliations and Related Volunteer Work
Activity: Member
Organization: University of Washington Extension Advisory Board for the Certificate Program in Electronic Discovery Management (2008-present)
Activity: Member
Organization: University of Washington Extension Advisory Board for the Certificate Program in Computer Forensics (2004-present)
Description: Advisory board for curriculum development of a certificate-non-credit training in computer forensics.
Activity: Member (2007 to present)
Former Chair (2003 to 2007)
Organization: Lake Washington Technical College, Kirkland, WA (2002 to present) Description: Academic advisory committee for the Computer Forensics degree program.
Activity: Member
Organization: The Computer Forensic Consortium (2002)
Description: Standards committee formed through Purdue University and the National Science Foundation to develop a “Body of Knowledge” for computer forensics.
CV-H.W.Nelson, Version of May 19, 2009 Page 4 of 14
Activity: Member of Board of Directors (1998 to present)
Former Vice President of Fife, Washington chapter (2004-2007)
Former President of Fife, Washington chapter (2000 to 2003)
Former Vice President, (1998 to 2000)
Organization: Computer Technology Investigators Network (CTIN www.ctin.org)
Description: Represent CTIN on all activities with local, county, state, and federal agencies as well as private sector entities that deal with computing investigations. Provide direction to other members on organization's daily operations.
Activity: Committee co-chair (2001)
Organization: Computer Investigations and Forensics Training Committee, CTIN
Description: A formal committee within CTIN established to develop training for the Washington State Criminal Justice Training Commission. At the request of the Washington State Attorney General and the Washington State Criminal Justice Training Commissions CTIN is designing and developing specialized computer and network investigation coursework for law enforcement and private sector investigators.
Activity: Member (1997 to present)
Organization: Agora
Description: An informal collective of government and business representatives dedicated to the exchange of information on cyber-crime and Internet security issues.
Activity: The Boeing Company's representative (1998 to 2004)
Organization: WE CARE
Description: A subcommittee of the Washington Association of Sheriffs and Police Chiefs. WE CARE was formerly the Electronic Crime Information Resource Group (ECIRG). The purpose of this organization is to develop public awareness programs on the threats and problems of computer crimes and Internet crimes.
Activity: Member (1997 to 2003)
Organization: C.R.I.M.E., Portland, Oregon
Description: Training and career enhancement organization.
Activity: Reserve Police Officer
Organization: Des Moines Police, Des Moines, WA (1975-1980)
Skills & Experiences: Performed routine patrol functions. Assisted in training of other reserve police officers. Assisted in several investigations including three homicide crime scenes. Processed traffic accident reports. Performed traffic control for various activities ranging from traffic accident investigations to crowd control. Performed fingerprint processing and filing utilizing the Henry system.
Activity: Reserve Police Officer
Organization: Medina Police, Medina, WA (1972-1973)
Skills & Experiences: Performed routine patrol functions. Assisted in training of other reserve police officers. Processed traffic accident investigations.
Military Service
United States Air Force Reserves 1969-1976
Medical Service Technician, E5, Honorably Discharged
Professional Presentations and Training
University of Idaho, Introduction to Computer Forensics Lecture Topic Online lecture NTFS Data Carving Techniques
November 2008
CTIN at Columbia Bank Training Center, Lakewood, WA Lecture Topic NTFS Data Carving Techniques
August 2008
The Boeing Company Office of Internal Governance Internal Audit Lecture Topic Computing Investigation processes
July 2008
The Boeing Company Law Dept. Litigation Staff Lecture Topic E-mail recovery for e-discovery May 2008
CTIN at Bellevue, WA Police Dept.
Lecture Topic Data acquisition tools and methods May 2008
University of Washington, Bothell, WA
Lecture Topic Suspect profiling and computer forensics exam April 2008
Pierce County Prosecutors Office, Tacoma, WA
Lecture Topic One-day training on use of X-Ways Forensics to local Sheriff investigators December 2007
Professional Group Highline Community College, High, Des Moines, WA Lecture Topic Data recovery techniques
December 2007
Systematic Approaches to Digital Forensic Engineering (SADFE-2007)
Lecture Topic Workshop tutorial on computer forensics to masters and PhD candidates April 2007
CTIN at Criminal Justice Training Commission Lecture Topic WinPE boot CD.
January 2006
Highline Community College, Des Moines, WA Lecture Topic Data acquisition methods
October 2005
CTIN at Lake Washington Technical College, Kirkland, WA
Lecture Topic Computing forensics and forensics accounting processes September 2005
CTIN at Lake Washington Technical College, Kirkland, WA
Lecture Topic Information assurance, University of Washington Certificate Program September 2005
- CV-H.W.Nelson, Version of May 19, 2009 Page 6 of 14
- University of Washington, Seattle, WA
Lecture Topic Computing investigation processes for Information Assurance graduate class July 2005
CTIN at North Seattle Community College, Seattle, WA Lecture Topic PDA & Cell data acquisition
May 2005
CTIN at Lake Washington Technical College, Kirkland, WA Lecture Topic Digital forensics documentation processes May 2005
Security Investigators Forum, Boeing, Orlando, FL
Lecture Topic Technical Enterprise Computing Investigation Services April 2005
Computing Security Forum, Boeing, Mesa, AZ
Lecture Topic Electronic Discovery & Digital Evidence for Systems Administrators April 2005
University of Washington, Seattle, WA
Lecture Topic Corporate investigation processes March 2005
CTIN at the Criminal Justice Training Commission (State Police Academy), Burien, WA Lecture Topic Linux data acquisition methods
February 2005
CTIN at North Seattle Community College, Seattle, WA
Lecture Topic File systems, computer forensics and data recovery October 2004
ASIS Olympic Mountains Western Washington State, Chapter 076 Lecture Topic Computer Forensics Lab Operations
August 2004
Professional Group Seattle University, Seattle, WA Lecture Topic Computing investigation processes July 2004
CTIN at Tacoma Sheraton Convention Center
Lecture Topic Panel discussion on data recovery needs for small businesses May 2004
CTIN at Lake Washington Technical College, Kirkland, WA Lecture Topic Digital Evidence validation methods
April 2004
CTIN at the Criminal Justice Training Commission (state Police Academy), Burien, WA
- CV-H.W.Nelson, Version of May 19, 2009
- Page 7 of 14
- 09-01127-rb Doc 35-2 FILED 07/16/09 ENTERED 07/16/09 14:32:40 Page 8 of 15
- Lecture Topic Frugal Computer Forensics March 2004
- Seattle University, Seattle, WA
Lecture Topic Career opportunities in Computer Forensics February 2004
Highline Community College, High-Tech Investigations Management, Des Moines, WA Lecture Topic Law Enforcement interacting with private sector security
January 2004
CTIN at Lake Washington Technical College, Kirkland, WA Lecture Topic Career opportunities in Computer Forensics October 2003
CTIN at North Seattle Community College, Seattle, WA Lecture Topic Current Computer Forensic Tools October 2003
IT Faculty Development Institute, Bellevue Community College, Bellevue, WA Lecture Topic Computing Security Skills Matrix, What Industry needs in its workforce August 2003
Criminal Justice Training Commission (State Police Academy), Police Dept., Mt. Vernon, WA Lecture Topic First Responder for Computer Crime Scenes
August 2003
CTIN at Seattle University, Seattle, WA
Lecture Topic Data Elimination Techniques for the Business Environment July 2003
CTIN at Seattle University, Seattle, WA
Lecture Topic Computer Forensics Operations and Management April 2003
CTIN at North Seattle Community College, Seattle, WA
Lecture Topic Computer Forensics Operations and Management. April 2003
CTIN at the Criminal Justice Training Commission (state Police Academy), Burien, WA Lecture Topic Basic Computing Investigation Processes
December 2002
Washington State Attorney General’s Office, Tort Division, Tacoma, WA Lecture Topic High-tech computer investigations case management December 2002
CTIN at the Criminal Justice Training Commission (state Police Academy), Burien, WA Lecture Topic Disk Drive Write-Blockers
October 2002
- CV-H.W.Nelson, Version of May 19, 2009
- Security Forum F-22 Boeing-Lockheed, Seattle, WA
Lecture Topic Data Elimination Techniques for Classified DoD Programs July 2002
Highline Community College, Network Operations & Computing, Des Moines, WA Lecture Topic Introduction to Computing & Network Forensics
May 2002
Spokane Falls Community College, Spokane, WA
Lecture Topic Basic Computing Investigations & Forensics—Three Day Workshop (compensation paid) May 2002
University of Washington, Continuing Education, Network Security, Bellevue, WA Lecture Topic Introduction to Computing & Network Forensics
May 2002
Security Forum, The Boeing Company, Seattle, WA
Lecture Topic Computing Investigations and Disk Drive Forensics April 2002
CTIN, Fife, WA
Lecture Topic Disk Drive Data Structures April 2002
DelSol.Net, Olympia, WA
Lecture Topic High-Tech Investigations Methods for Public/Private Partnership October 2001
CTIN, Fife, WA
Lecture Topic AccessData Forensic Tool Kit October 2001
Qwest, Bellevue, WA
Lecture Topic Computing Investigations & Forensics (compensation paid) October 2001
CTIN, Fife, WA
Lecture Topic Low cost alternative computing investigation tools October 2001
CTIN, Fife, WA
Lecture Topic ILook Forensic Tool March 2001
CTIN, Everett, WA
Lecture Topic ILook Forensic Tool January 2001
CTIN, Fife, WA
Lecture Topic NTFS Data Structures February 2000
CTIN at City University, Renton, WA
Lecture Topic Systems Analysis Applied to Computing Investigations (CLE) March 2000
Northwest Computer Training Workshop, Sun River, OR
Lecture Topic Systems Analysis Applied to Computing Investigations October 1998
CTIN, Seattle, WA
Lecture Topic Systems Analysis Applied to Computing Investigations (CLE) September 1998
C.R.I.M.E., Portland, OR
Lecture Topic Network Investigation Methods June 1998
Northwest Computer Training Workshop, Sun River, OR Lecture Topic Hacker Methods
October 1997
Formal Education
B.S. Data Processing, Griffin College, Seattle, Washington 1985
A.A. Media Technician, Bellevue Community College, Bellevue, Washington 1974
Formal Courses & Workshops Attended
Imaging Vista Volume Shadow Copies & Windows FE—Troy Larson lecturing, Criminal Justice Training Center, Seattle, WA
Hours 3.0, April 2009
542 Web Application Penetration Testing & Ethical Hacking, www.sans.org held in Vancouver, BC Canada Hours 32.0, completed November 2008
319 Introduction to Web Application Security, www.sans.org held in Vancouver, BC Canada Hours 16.0, completed November 2008
Information Security Compliance & Risk Management, University of Washington Hours 16.0, completed September 2008
Cyber Conflict Studies, Response Options, Norwich University held at University of Washington Hours 6.0, completed March 2008
AccessData Internet Forensics Course, Des Moines, WA Hours 24.0, completed October 2007
Innovations in Digital Forensics Practices, Norwich University Hours 24.0, completed March 2006
CV-H.W.Nelson, Version of May 19, 2009 Page 10 of 14
Cyber Conflict Studies, Attribution, Norwich University Hours 6.0, completed March 2006
X-Ways Forensics & WinHex—X-Ways Software Technologies—Stefan Fleischmann instructing Hours 32.0, completed January 2005
Electronic Discovery New Weapons-- New Land-mines, by David Isom Hours 7.0, completed April 2004
Presenting Data & Information, by Edward Tufte Hours 6.0, completed July 2003
Top Officials (TOPOFF) II Cyber Terrorism Conference for Homeland Security Hours 7.0, completed March 2003
Laptop Security
Hours. 0.5, completed October 2002
ADRA-Inet, NW3C
Hours 8.0, completed October 2002
AccessData Forensic Boot Camp Hours 20.0, completed June 2002
2002 Security Training
Hours 0.7, completed April 2002
NTI The Computer in Court: Presenting Expert Testimony on Electronic Evidence Hours 24.0, completed January 2002
NTI Data Hiding
Hours 8.0, completed September 2000
NTI Internet Investigations
Hours 8.0, completed September 2000
NTI Windows NTFS
Hours 16.0, completed June 2000
ITAR & EAR Export Control Level 3 Hours 1.5, completed May 2000
ITAR & EAR Export Compliance & Control Hours 2.0, completed May 2000
ITAR & EAR Export Control Awareness Hours 0.2, completed February 2000
A+ Course
Hours 50.0, completed March 1999
MCSE
Hours 150.0, completed March 1999
NTI Computer Incident Response MS-DOS Hours 20.0, completed September 1999
Fraud Awareness Seminar
Hours 24.0, completed March 1999
Northwest Computer Training Workshop Hours 20.0, completed October 1998
Hackers/Crackers/Sniffers
Hours 24.0, completed March 1997
CyberCop 101, National White-collar Crime Administration Hours 36.0, completed October 1997
Northwest Computer Training Workshop Hours 19.0, completed October 1997
Computing Security—Doing Business on the Web Hours 1.0, completed March 1997
Project Management
Hours 24.0, completed April 1996
UNIX System Administration Hours 40.0, completed March 1994
Introduction to UNIX
Hours 40, completed March 1994
C Programming
Hours 30.0, completed January 1993
C Programming
Hours 24.0, completed September 1989
Security Awareness
Hours 0.5, completed August 1989
VAX Internals for System Managers Hours 32.0, completed June 1989
Ada Programming
Hours 40.0, completed April 1989
Ada Structure Programming
CV-H.W.Nelson, Version of May 19, 2009
Hours 24.0, completed March 1989
Business Analysis
Hours 24.0, completed March 1989
BCS Ethics
Hours 1.0, completed December 1988
Budget & Finance
Hours 6.0, completed August 1988
Fundamentals of Budgeting
Hours 6.0, completed August 1988
Business Law
Hours 30.0, completed July 1988
Business Ethics for Sales/Marketing Hours 4.0, completed June 1988
Apollo/Aegis Operating System Hours 12.0, completed April 1988
DEC VAX System Management Hours 32.0, completed April 1988
Labor Charging
Hours 1.0, completed November 1986
Introduction to Ada Programming Hours 36.0, completed February 1987
Formal Investigation & Police Science Courses Attended
205: National Security Policy and Counterintelligence Implications of Denial and Deception Practices—CI Centre (www.cicentre.com), Alexandria, VA
Hours 24.0, completed June 2005
High Technologies Crime Investigation Workshop, Newport, OR Hours 8.0, completed March 1997
Private Investigation, Green River Community College, Auburn, WA Hours 108.0, completed May 1997
Reserve Police Officers Academy, Des Moines Police, Des Moines, WA Hours 79.0, completed March 1979
Institute of Applied Science, Fingerprinting & Investigation Procedures, Syracuse, NY Correspondence course, completed November 1978
Hardware Experience
DEC VAX: 11/785, 8350, 8600, 8800, MicroVAX, VAX Clusters and peripherals. Assorted microcomputers: PC, Apollo DN3000 Workstations, and Apollo File Servers. NEC: S3400, 430, 140 Minicomputers, and EWS 4800 Workstations, Digital Intelligence F.R.E.D and F.R.E.D.D.I.E. forensic workstations, Firewire & USB 2.0 write-blocker data acquisition systems, SCSI write-blocker data acquisition bridges
Operating Systems Experience
UNIX, Linux, MS-DOS, Win95, Win98, WinNT, Win2K, VAX/VMS, Apollo Aegis, ACOS-4, NCOS, DECNET, TCP/IP, Token-Ring Networking, BASIC, COBOL, FORTRAN, Ada, C, DCL, JCL, ADBS, Linux distributions—Fedora/Red Hat, Mandrake, Debian, Ubuntu & Kubuntu, Helix, & Knoppix.
Computer Forensic Tools Experience
NTI Computer Incident Response Suite (MS-DOS & Win9x) and Windows NTFS Suite Guidance Software EnCase version 1.99B, 2.17, 3.0
Digital Intelligence Drive Spy, PDBlock, PDWipe, Image
Access Data Ultimate Took Kit
dtSearch
Runtime GetDataBack, DiskExplorer, and HDHost
ASRData SMART
ILook versions 5.0.0 through 7.0.36
X-Ways WinHex, X-Ways Forensics, X-Ways Trace, Replica, Capture, Evidor, Davory, Security Technology Pathways ProDiscover
Paraben PDA and Cell phone seizure
Autopsy and Sleuth kit
Knoppix STD
Helix
Publications
Guide to Computer Forensics and Investigations, Nelson, Bill (Lead Author)
Thomson Course Technologies, First Edition: ISBN 0-619-13120-0, Copyright 2004; Second Edition: ISBN 0-619-21706-5, Copyright 2005; Third Edition: ISBN 1-418-06331-2, Copyright 2008; Fourth Edition: ISBN 1-435-49883-6, Copyright 2009
Book listed on the January 2004 FBI Forensic Science Communications Book Review list
Reviewed by: Gary C. Kessler, Program Director, Computer and Digital Forensics, Champlain College, Burlington, Vermont (http://www.fbi.gov/hq/lab/fsc/backissu/jan2004/2004_0 1_book0 1 .htm or http://www.garykessler.net/library/fsc_CompFor_review.html)
CV-H.W.Nelson, Version of May 19, 2009 Page 14 of 14
|
