Course Overview

The needs for computer forensic experts are growing in corporations, law firms, insurance agencies, and law enforcement. Organizations are now realizing that evidence retrieved from computers and other digital media are becoming more relevant to convicting hackers and criminals. Trainees will take a detailed hands on approach to the use of computer technology in investigating computer crime. From network security breaches to child pornography, the common bridge is the demonstration that particular electronic media contains incriminating evidence. Though this digital evidence can be powerful, but if it is not retrieved through proper investigative procedure, it can be easily damaged and ruled inadmissible in a court of law. Using modern forensic tools and techniques, trainees will learn how to conduct structured investigation process in such a way that the results are useful in criminal proceedings. Trainees will learn different aspects of digital evidence: ways to uncover illegal or illicit activities left on disk and recovering files from intentionally damaged media with computer forensics tools and techniques.

The course covers both the principles and practice of digital forensics. Societal and legal impact of computer activity: computer crime, intellectual property, privacy issues, legal codes; risks, vulnerabilities, and countermeasures; methods and standards for extraction, preservation, and deposition of legal evidence in a court of law. This course provides hands-on experience in different computer forensics situations that are applicable to the real world.

Teaching Methodology

The training will be the principal teaching method. “Handouts” and sample programs will be available on the class web page. YouTube video notes are posted for the key concepts presented in this course. Class discussions will be conducted pertaining to the lab exercises. Software demos and overhead slides will be used.

Course Outcomes

Upon completion of this course, students will be able to:

1. Explain digital forensics and investigations on digital media.
2. Identify relevant electronic evidence associated with various violations of specific laws, including, but not limited to, computer crimes.
3. Locate and recover relevant electronic evidence from digital media using a variety of tools.
4. Identify and articulate probable cause as necessary to obtain a warrant to search for electronic artifacts and recognize the limits of warrants.
5. Explain the principles and practice of ethics and law for computer forensics investigators.
6. Explain how to manage/conduct a computer crime investigation involving digital media.
7. Follow a document investigations process.
8. Present the evidence and conclusions of an investigation in a report form.
9. Describe core computer science theory necessary to perform computer forensics