On the basis of

• IMT2282- Operating Systems
• IMT2431- Data Communication and Network Security

Expected learning outcomes

Students are introduced to the fundamental principles of digitalforensics. The students will be expected to be able to survey a digitalcrime scene and to acquire, analyze, and present digital evidence in aforensically sound manner.

Topic(s)

• Digital investigations and evidence
• Chain of custodu and forensic soundness
• Timeline analysis
• Live system forensics
• File system forensics
• Forensic reconstructions
• Advanced topics if time permits

Teaching Methods

Lectures
Laboratory work

Form(s) of Assessment

Other

Form(s) of Assessment (additional text)

An overall evaluation based on a 100 point scale, where project work counts 50 points and final exam (3 hours) counts 50 points (at least 18 MUST be obtained). Conversion from 100 point scale to A-F scale according to recommended conversion table. In specific circumstances, emneansvarlig can slightly adjust the limits in the conversion table to enforce compatibility with the qualitative descriptions on the A-F scale.

Grading Scale

Alphabetical Scale, A(best) – F (fail)

External/internal examiner

Internal examiner

Re-sit examination

For the final exam: Ordinary re-sit examnination.

Coursework Requirements

Will be announced later

Teaching Materials

• Dan Farmer and Wietse Venema: Forensic Discovery, Addison-Wesley, 2005
• Presentation material and selected academic papers

Replacement course for

IMT3711 Digital Forensic Science

Additional information

Knowledge of Linux is an advantage

In case there will be less than 5 students that will apply for the course, it will be at the discretion of Studieprogramansvarlig whether the course will be offered or not an if yes, in which form.