Digital Forensics

Abstract

This subject provides an in-depth study of the rapidly changing and fascinating field of computer forensics. It combines both the technical expertise and the knowledge required to investigate, detect and prevent digital crimes. The subject covers the knowledge on digital forensics legislations, digital crime, forensics processes and procedures, data acquisition and validation, e-discovery tools, e-evidence collection and preservation, investigating operating systems and file systems, network forensics, art of steganography and mobile device forensics, email and web forensics, presenting reports and testimony as an expert witness.

Syllabus

Relevant legislation and codes of ethicsDigital crime, civil and criminal lawComputer forensics and the digital detectiveForensic processes, policies and proceduresFraud and forensic accountingE-Discovery, guidelines and standardsE-Evidence, tools, environments and equipmentSystems basics and file systemsInvestigating operating systemsEmail and web forensicsNetwork forensics and intrusion detectionReporting and presenting

Relevant legislation and codes of ethics
Digital crime, civil and criminal law
Computer forensics and the digital detective
Forensic processes, policies and procedures
Fraud and forensic accounting
E-Discovery, guidelines and standards
E-Evidence, tools, environments and equipment
Systems basics and file systems
Investigating operating systems
Email and web forensics
Network forensics and intrusion detection
Reporting and presenting

Learning outcomes

Upon successful completion of this subject, students should:

be able to determine and explain the legal and ethical considerations for investigating and prosecuting digital crimes;

be able to formulate a digital forensics process;

be able to evaluate the technology in digital forensics to detect, prevent and recover from digital crimes;

be able to analyse data on storage media and various file systems;

be able to collect electronic evidence without compromising the original data;

be able to evaluate the functions and features of digital forensics equipment, the environment and the tools for a digital forensics lab;

be able to critique and compose technical tactics in digital crimes and assess the steps involved in a digital forensics investigation; and

be able to prepare and defend reports on the results of an investigation.

Assumed knowledge

ITC595

Enrolment restrictions

Only available to postgraduate students.