About Our Staff

Brief Abstract of Staff Member Knowledge, Skills, and Abilities Relating to Computer Forensics

Return to Main Forensics Help Page

Stephen M. Bunting, CCFT, EnCE
Captain - University of Delaware Police
Email

Captain Bunting is an experienced computer forensics examiner, having conducted examinations of computer systems for the University of Delaware Police as well as federal, state, and local law enforcement and prosecutorial agencies. He is also a trained and experienced forensic video analyst using the Ocean Systems dTective® and Avid software systems. He is a frequent lecturer and instructor on computer forensics, cyber-crime, and incident response.

Captain Bunting has testified many times as a computer forensics expert. He was the recipient of the 2002 Guidance Software Certified Examiner Award of Excellence. He is an EnCase Certified Examiner (Guidance Software) and a Certified Computer Forensics Technician (HTCN).

Captain Bunting has been a sworn police officer in the State of Delaware for over thirty years. He created and developed the University of Delaware Police Department's Computer Forensic Lab. He has taught computer forensics for Guidance Software, makers of EnCase, and taught as a Lead Instructor at all course levels, including the Expert Series with particular emphasis on "Internet and Email Examinations" course. He has instructed students in computer forensics on an independent study basis for the University of Delaware and is an adjunct faculty member of Goldey-Beacom College, teaching computer forensics. He has been a presenter at several seminars and workshops, the author of numerous "white papers", the principle author of EnCase Computer Forensics - The Official EnCE: EnCase Certilfied Examiner Study Guide, the co-author of Mastering Windows Network Forensics and Investigation , the author of EnCase Computer Forensics--The Official EnCE: EnCase Certified Examiner Study Guide, 2nd Edition (all published by Wiley), and maintains a website for cyber-crime and computer forensics issues.

Certifications:

Certified Computer Forensic Technician, High Tech Crime Network, original certification 9/27/2001

EnCase Certified Examiner, Guidance Software, original certification 4/4/2002, last recertification 4/4/2006

Certified Cell Phone Examiner, Paraben Corporation, May 2005

Certified PDA Examiner, Paraben Corporation, May 2005

State of Delaware Council on Police Training Certified Police Officer (1975)

Memberships and Affiliations:

	The Law Enforcement & Emergency Services Video Association, member since October 2004
	Infragard – secure member of the Wilmington, Delaware Chapter since June 2004.
	High Technology Crime Investigation Association - member since August 2002.
	High Tech Crime Network - member from September 2001 to date.
	National White Collar Crime Center - designated agency contact person for agency membership in the organization - January 2001 to date.

Formal Education and Degrees:

University of Delaware - Computer Applications Certificate – Concentration in Network Environments - August 2004

Wilmington College - Bachelor of Science Applied Professions / Business Management - May 1986

Delaware Technical and Community College - 52 credit hours in the Criminal Justice Program

University of Delaware - Associate in Art - May 1973

Publications and White Papers:

EnCase Computer Forensics--The Official EnCE: EnCase Certified Examiner Study Guide, 2nd Edition - author - Wiley - November 2007

Mastering Windows Network Forensics and Investigation (one of two co-authors) - Wiley - April 2007

Encase Computer Forensics--The Official EnCE: Encase Certified Examiner Study Guide (principle author) - Wiley - March 2006

EnCase Internet and Email Examinations - Guidance Software Publication (Version 4 Series - 2004) - contributing author

Creating Paperless EnCase Computer Forensic Reports on CD - August 2003

Disabling the Yahoo Login Script for Viewing in Forensic Reports - May 2003

Examination of Photoshop Text Layer Metadata in Support of Forged Document Examinations - January 2003

"Meeting the Training Needs Imposed by Internet Crime", The Informant, publication by the National White Collar Crime Center, March 2001 Issue.

"Meeting the Training Needs Imposed by Internet Crime", IADLEST Newsletter, January 2001 Issue.

Classes and presentations Captain Bunting has conducted:

	Advanced Computer Forensics Techniques - Computer Forensics Analysis and Training Center - June 4-5, 2009 - Sharon Hill, PA.
	Cyberbullying - May 11, 2009 - Long Neck Elementary School - Millsboro, DE
	"Computer Forensics - Current State and Future Challenges" - Computer Crimes Colloquium - April 7, 2009 - Wilmington University - Dover, DE
	Identity Theft - City of Lewes Neighborhood Watch Meeting - March 23, 2009 - Lewes, DE
	Disaster Recovery (CIS 486) - Goldey-Beacom College - January to March 2009 - Wilmington, DE.
	Introduction to Computer Forensics - Computer Forensics Analysis and Training Center - February 13-14, 2009 - Sharon Hill, PA.
	Advanced Computer Forensics Techniques - Computer Forensics Analysis and Training Center - December 4, 2008 - Sharon Hill, PA.
	Computer Forensics (CIS 362) - Goldey-Beacom College - October to December 2008 - Wilmington, DE.
	Forensic Acquisition and Analysis - November 16-20, 2008, Dubai Police Department, Dubai, UAE
	Cyber Stalking - Delaware Domestic Violence Council - Dover Police Department, November 7, 2008, Dover, DE
	Advanced Computer Forensics - September 22-26, 2008, Sidley - Austin in Chicago, IL
	Computer Forensics Primer for the Press - September 17, 2008 - Delaware Valley Press Club - Chester, PA.
	Investigating Crimes Involving Computers - August 28-29, 2008 - Newark, DE.
	Introduction to Computer Forensics - Computer Forensics Analysis and Training Center - August 26-27, 2008 - Sharon Hill, PA.
	Crimes Involving Computers - First Response - University of Delaware - August 28-29, 2008 - Newark, DE
	Disaster Recovery (CIS 486) - Goldey-Beacom College - March to April 2008 - Wilmington, DE.
	Computer Forensics (CIS 362) - Goldey-Beacom College - October to December 2007 - Wilmington, DE.
	Computer Forensics for Medical / Legal Professionals - University of Delaware Special Programs - November 9, 2007
	Windows Network Investigations and Forensics - HTCIA Regional Training - June 19, 2007 - Newark, DE
	User Services - First Response to Crime Scenes Workshop - Special Interest Group on University and College Computing Services - Edmonton, Canada - November 5, 2006
	Cyber Stalking - Delaware Domestic Violence Council - November 16, 2006 - Dover, DE.
	Computer Forensics for Prosecutors - Delaware Attorney General Staff - September 28, 2006 - Dewey Beach, DE.
	CyberSpeak Podcast - Microsoft Log Parser Forensic Applications - June 3, 2006
	CyberSpeak Podcast - User Assist Registry Key and Restore Point Forensics - May 13, 2006
	Investigation of Cyber Incidents - University of Delaware System Administrators Group - May 17, 2006 - Newark, DE
	Identity Theft and Cyber Safety - DuPont Experimental Station Staff - March 14, 2006 - Wilmington, DE.
	Computer Forensics for Prosecutors - Delaware Attorney General Staff - September 22, 2005 - Lewes, DE.
	First Response Issues for Crimes Involving Computers - Hosted by the U.S. Attorney's Office - September 16, 2005 - Dover, DE.
	Examination of Photoshop Layer Data - Fairfax, VA - RCFG GMU 2005 - August 15 & 18, 2005 - Guest Lecturer
	Cyber-sabotage, Espionage, & Other Security Threats, February 23, 2005, Lorman Education Services, Newark, DE
	Computer Forensics in the Courtroom, January 7, 2005, Widener University School of Law, Wilmington, DE
	Computer Forensics for Prosecutors - Delaware Attorney General Staff - September 30 - October 1, 2004 - Dewey Beach, DE.
	Forensic Examination of Peer-to-Peer Client Software Artifacts -NJSP High Tech Crime Unit. September 22, 2004, Trenton, NJ.
	Introductory Computer Forensics Guidance Software - Sterling, VA Jun 29 - Jul 2, 2004 (32 hrs) Lead Instructor
	Internet / Email Examinations Guidance Software - Sterling, VA Jun 22 - 25, 2004 (32 hrs) Lead Instructor
	Email Examinations Lab at CEIC 2004 Myrtle Beach, SC Jun 6 - 9, 2004 (7.5 hrs - five presentations) Lead Instructor
	Photoshop Layer Metadata Examinations CEIC 2004 Myrtle Beach, SC Jun 8, 2004 (1.5 hrs) Guest Lecturer
	Introductory Computer Forensics Guidance Software - Sterling, VA Apr 27 - 30, 2004 (32 hrs) Lead Instructor
	Internet / Email Examinations Guidance Software - Sterling, VA Mar 30 - Apr 2, 2004 (32 hrs) Instructor
	Internet / Email Examinations Guidance Software - Sterling, VA Feb 3-6, 2004 (32 hrs) Instructor
	Introductory Computer Forensics Guidance Software - Sterling, VA Jan 6-9, 2004 (32 hrs) Lead Instructor
	Internet / Email Examinations Guidance Software - Sterling, VA Nov 18-21, 2003 (32 hrs) Instructor
	Introductory Computer Forensics Guidance Software - Sterling, VA Oct 21-24, 2003 (32 hrs) Instructor
	Intermediate Analysis & Reporting Guidance Software - Sterling, VA Sept 9-12, 2003 (32 hrs) Instructor
	Introductory Computer Forensics Guidance Software - Sterling, VA Aug 12-15, 2003 (32 hrs) Instructor
	Introductory Computer Forensics Guidance Software - Sterling, VA July 8-11, 2003 (32 hrs) Instructor
	Intermediate Analysis & Reporting Guidance Software - Sterling, VA June 17-20, 2003 (32 hrs) Instructor
	Internet / Email Guidance Software - Sterling, VA May 6-9, 2003 (32 hrs) Instructor
	Intermediate Analysis & Reporting Guidance Software - Sterling, VA Mar 4-7, 2003 (32 hrs) Instructor
	Introductory Computer Forensics Guidance Software - Sterling, VA Feb 25-28, 2003 (32 hrs) Instructor
	Internet Safety for Children - Winter / Spring 2003 semester offering through the University of Delaware Continuing Education Division
	CyberStalking and Related Crimes Involving Computers: October 7, 2002 in Newark, DE.
	Computer Crime Issues for Prosecutors: - Presented to the Wicomico County States Attorney's Office (4/20/01) and to the Attorney General's Office for the State of Delaware Sex Crimes Unit (10/4/02).
	Computer Forensics: - during the spring semester 2002, supervised and directed an independent course of study in computer forensics for a University of Delaware senior majoring in computer science. Program was under the auspices of Professor Chien-Chung Shen. Student is now employed with Price, Waterhouse, Cooper in the computer forensics division.
	The Internet as an Investigative Tool: Presented at the University of Delaware (5 presentations: 12/5/00, 1/8/01, 8/6/01, 8/13/01, & 8/26-27/02 ), at the Eastern Shore Criminal Justice Academy (3 presentations: 2/16/01, 3/8/01, and 3/20/01), and at Mount St. Mary's College (6/26/02).
	Computer Crimes: 1^st Responder Issues - course developed and presented to the University of Delaware Police as a 2 hour block during in-service training. Presented May 31, 2001, June 7, 2001, May 30, 2002, and June 5, 2002.

Training Captain Bunting has received includes:

Microsoft Exchange Server 2007	Global Knowledge - January 26-30, 2009 Arlington, VA
HTCIA Conference	High Tech Crime Investigator's Association - Oct 20-22, 2008, Atlantic City, NJ
Neutrino Cell Phone Forensics (16 hrs)	Guidance Software - January 15 – 16, 2008, Sterling, VA.
Macintosh Forensics (40 hrs)	Phoenix Data Group - October 15-19, 2007 - Sharon Hill, PA
Vista Forensics (16 hrs)	Access Data - July 20, 2007 - Washington, DC
Advanced Windows Intrusion Investigator’s Course (40 hrs)	SYTEX - February 27 – March 3, 2006, FBI Academy, Quantico, VA
Adobe Photoshop for Forensic Video Analysts ( 16 hrs)	Resolution Video - December 14-15, 2005 - Reston, VA
Regional Computer Forensics Group Seminar (40 hrs)	RCFG / HTCIA - August 15-19, 2005 - GMU - Fairfax, VA.
Cell Seizure (16 hrs)	Paraben - May 18 - 19, 2005 - Newark, DE
PDS Seizure (16 hrs)	Paraben - May 16 - 17, 2005 - Newark, DE
Enterprise Security & Vulnerability (36 hrs)	USSS / SEARCH - April 18-22, 2005 in Cherry Hill, NJ
Access Data FTK Advanced Internet Training Course (24 hrs)	Access Data - March 15 – 17, 2005 in Dover, DE.
Ocean Systems: dTective (Advanced Video Forensic Analysis ) (16 hrs)	Ocean Systems - Feb. 24 – 25, 2005 in Burtonsville, MD.
Advanced UNIX Intrusion Investigator’s Course (40 hrs)	SYTEX - December 6 – 10, 2004, Ellicott City, MD.
EnCase EnScript Programming (32 hrs)	Guidance Software - November 16 – 19, 2004, Sterling, VA.
Networks and Networking for Agents / System Security and Exploitation (80 hrs)	SYTEX - October 18 – 29, 2004, Ellicott City, MD.
Law Enforcement Video Association Annual Training Conference 2004 (16 hrs)	LEVA - October 6 – 7, 2004 Washington, D.C.
NIJ Law Enforcement Technology Institute 2004 (40 hrs)	NIJ - July 11 – 16, 2004, Washington, D.C.
Computer and Enterprise Investigations Conference / TechnoSecurity Conference 2004 (28 hrs)	Guidance Software - June 6 – 9, 2004 in Myrtle Beach, SC.
Ocean Systems: dTective (Advanced Video Forensic Analysis ) (16 hrs)	Ocean Systems - May 6 – 7, 2004 in Burtonsville, MD.
Ocean Systems: Introduction to Forensic Video Examinations (24 hrs)	Ocean Systems - May 3 – 5, 2004 in Burtonsville, MD.
Access Data FTK Intermediate Training Course (24 hrs)	Access Data - April 5 – 7, 2004 in Dover, DE.
EnCase Expert Series: Internet & Email Examinations (32 hrs)	Guidance Software - February 4 - 7, 2003 in Sterling, VA.
EnCase Advanced Computer Forensics (32 hrs)	Guidance Software - January 21- 24, 2002 in Sterling, VA.
Introduction to Programming Concepts (Visual Basic 6) (50 hrs)	University of Delaware Course - Wilm, DE – Fall 2002
Computer and Enterprise Investigations Conference 2002 (16 hrs)	Guidance Software - September 16-17, 2002 Chantilly, VA.
Regional Computer Forensics Group Seminar (40 hrs)	RCFG / HTCIA - August 12-16, 2002 - GMU - Fairfax, VA.
ILook Computer Forensics Software (24 hrs)	ACES / FBI / IRS / NCFS - July 23-25, 2002 Orlando, FL.
Firewalls and Virtual Private Networks (16 hrs)	CSI / NIPC / FBI - May 22-23, 2002 MSP - Columbia, MD.
Internet Investigations and Child Exploitation Overview (8 hrs)	SEARCH - April 6, 2002, CCU - Conway, SC.
Techno-Security 2002 Conference (28 hrs)	The Training Company April 7-10, 2002 - Myrtle Beach, SC
Enterprise Networks (50 hrs)	University of Delaware - Wilm, DE - Spring 2002
EnCase Advanced Computer Forensics (32 hrs)	Guidance Software - February 19-22, 2002 - Leesburg, VA.
LAN (Local Area Networks) (50 hrs)	University of Delaware - Newark, DE - Fall 2001
EnCase Intermediate Computer Forensics (32 hrs)	Guidance Software - August 7-10, 2001 - Leesburg, VA .
Techno-Security 2001 Conference (28 hrs)	The Training Company April 22-25, 2001 - Myrtle Beach, SC
WAN (Wide Area Networks) (50 hrs)	University of Delaware - Newark, DE - Spring 2001
Advanced Data Recovery and Analysis Course (40 hrs)	NW3C October 23-27, 2000 - Fairmont, WV.
The Internet as in Investigative Tool (8 hrs)	NW3C / IFCC October 12, 2000 - Fairmont, WV.
Basic Data Recovery and Analysis Course (40 hrs)	NW3C July 24-28, 2000 in Myrtle Beach, SC.

This web site was created to provide assistance to computer forensics examiners engaging in cyber-crime investigations. This field is rapidly evolving and changing as technology marches forward. It is, therefore, intended to be a growing and evolving resource. As you conduct your examinations and investigations, if you encounter information, links, or have suggestions that would help others, please let me know so I can add it to this site. My email address is sbunting@udel.edu . Thank you.

	This site created and maintained by:

	Steve Bunting

	Email: sbunting@udel.edu