1. GUC
  2. Course catalogue
  3. Student handbook
  4. Study plans 2016-2017
  5. Courses 2016-2017
  6. Avdeling for informatikk og medieteknikk
  7. IMT4114 Introduction Digital Forensics

Introduction Digital Forensics
Study plans 2016-2017 - IMT4114 - 7.5 ECTS

Expected learning outcomes

Knowledge :

  • Digital Forensics methodology with a solid understanding of requirements for handling digital evidence
  • Requirements and impact on maintaining evidence integrity and chain of custody
  • Principles, procedures, and the basic concepts of forensic standards and best practices, e.g. forensic tool testing
  • The overall process for establishment and maintenance of a digital forensic lab environment
  • The role of expert witnesses and digital evidence in the context of legal proceedings
  • The role of policies, standards and guidelines for controls and is capable of applying his/her knowledge in case studies
  • Legal, privacy and ethical aspects of digital forensics investigations.

Skills :

  • Forensic acquisition of digital evidence from computer and network media
  • Live system forensics and evaluation of order of volatility
  • Evidence analysis with timeline analysis and forensic reconstruction
  • Scientific documentation of forensic acquisition and analysis
  • Applying forensic principles on practical case-studies
  • Performing stakeholder analysis, risk assessment and forensic triage on limited case-studies
  • Evaluating the applicability of forensic methods and tools for various controls given a certain scope and policy for the control

General competence :

  • Capability of analyzing business, legal, ethical and case-specific requirements for planning and conducting a digital forensics investigation
  • Understanding of forensic analysis and incident response processes
  • Working independently and familiarity with digital forensics terminology
  • Capability of discussing professional problems such as documentation, decision making processes, implementation plans, operations, reviews and corrective actions, with forensic experts, IT specialists and general managers
  • Learning skills to continue acquiring new knowledge and skills in a largely self-directed manner
  • Ability to contribute to innovative thinking and innovation processes

Topic(s)

  • Digital investigations, stakeholders and their roles
  • Digital evidence, e.g. acquisition, admissibility, authenticity
  • Chain of custody, evidence integrity and forensic soundness
  • File and live system forensics
  • Timeline analysis
  • Forensic reconstructions
  • Internet and network forensics
  • Automation and forensic tools
  • Reporting and presenting evidence
  • Expert witness and cyber crime law
  • Computational forensics
  • Forensic readiness
  • Advanced topics if time permits

Teaching Methods

Lectures
Group works
Laboratory work
E-learning
Net Support Learning
Project work

Teaching Methods (additional text)

The course will be made accessible for both campus and remote students. Every student is free to choose the pedagogic arrangement form that is best fitted for her/his own requirement. The lectures in the course will be given on campus and are open for both categories of students. All the lectures will also be available on Internet through the university’s learning management system.

Form(s) of Assessment

Written exam, 3 hours
Evaluation of Project(s)

Form(s) of Assessment (additional text)

An average where project work counts for 50%, and final written exam counts for 50% of the grade according to the recommended averaging process.

Both parts must be passed.

Grading Scale

Alphabetical Scale, A(best) – F (fail)

External/internal examiner

Evaluated by internal examiner, external examiner is used periodically every fifth year, next time fall 2018.

Re-sit examination

For the final written exam: Ordinary re-sit examination in August.

Examination support

None except lexicon to/from any language and English.

Coursework Requirements

The students are required to follow/attend the lab work sessions and complete all required hand-ins. (The lab sessions will be made available to remote students electronically).

Groupwise oral presentation of project work must be approved.

Teaching Materials

Course book/papers/supplementary materials, such as; Digital Forensics, André Årnes ed., lecture and other presentation materials and selected papers.

Replacement course for

IMT4012 Digital forensics 1

Additional information

Knowledge of Linux is an advantage. The course will be held in English.