Digital Forensics
2011-2012 - IMT3551 - 5 ECTS

On the basis of

IMT2282- Operating Systems
IMT2431- Data Communication and Network Security

Expected learning outcomes

Students are able to explain the fundamental principles of digital forensics. The students are able to survey a digital crime scene and to acquire, analyze and present digital evidence in a forensically sound manner.

Topic(s)

Digital investigations and evidence
Chain of custodu and forensic soundness
Timeline analysis
Live system forensics
File system forensics
Forensic reconstructions
Advanced topics if time permits

Teaching Methods

Lectures
Laboratory work

Form(s) of Assessment

Other

Form(s) of Assessment (additional text)

An overall evaluation based on a 100 point scale, where project work counts 50 points and final exam (3 hours) counts 50 points (at least 18 MUST be obtained). Conversion from 100 point scale to A-F scale according to recommended conversion table. In specific circumstances, the course responsible can slightly adjust the limits in the conversion table to enforce compatibility with the qualitative descriptions on the A-F scale.

Grading Scale

Alphabetical Scale, A(best) – F (fail)

External/internal examiner

Internal examiner

Re-sit examination

For the final exam: Ordinary re-sit examnination.

Coursework Requirements

Will be announced later

Teaching Materials

Dan Farmer and Wietse Venema: Forensic Discovery, Addison-Wesley, 2005
Presentation material and selected academic papers

Replacement course for

IMT3711 Digital Forensic Science

Additional information

Knowledge of Linux is an advantage

In case there will be less than 5 students that will apply for the course, it will be at the discretion of Studieprogramansvarlig whether the course will be offered or not an if yes, in which form.