DIGITAL FORENSICS

Course Description

The main objective of this course is to teach students different techniques and procedures that enables them to perform digital investigation. This course focuses mainly on the analysis of physical storage media and volume analysis. It covers the major phases of digital investigation such as preservation, analysis and acquisition of artifacts that reside in hard disks and random access memory. At the completion of the course, student will be able to create a digital image of physical storage device, they will be able to recovered deleted digital information and they will be able to use common digital forensics tools. Students will also be able to analyze various cases to determine digital actions of a user and perform digital analysis of varieties of files

DIGITAL FORENSICS

Evaluation Tools (Active Term)

No evaluation items have been defined.

Course outcomes

No course outcomes have been defined yet.

Course Syllabus

Reference Books & Course Materials

No reference books have been listed.

Learning Outcomes

1. L01 Explain the fundamental concepts, scope, and importance of digital forensics in cybersecurity investigations. SOLO 4
2. L02 Describe the characteristics of cybercrimes, digital evidence, and the rules of evidence used in forensic investigations. SOLO 3
3. L03 Apply the main stages of the computer forensics investigation process, including crime scene handling, evidence processing, and documentation. SOLO 4
4. L04 Perform data acquisition, duplication, and hashing procedures to preserve the integrity of digital evidence. SOLO 4
5. L05 Analyze storage media, file systems, Windows registry, boot processes, and disk encryption artifacts during forensic examinations. SOLO 4
6. L06 Apply common digital forensic tools and validation methods to recover, examine, and interpret digital artifacts. SOLO 4
7. L07 Examine graphics files, deleted images, steganalysis indicators, and artifacts related to virtual machine, network, e-mail, and social media forensics. SOLO 3
8. L08 Evaluate forensic practices in relation to legal, ethical, and professional responsibilities, including evidence handling, forensic readiness, and business continuity. SOLO 5

Program Outcomes

1. P01 Demonstrate comprehensive knowledge of key concepts across the breadth of effective application and use of MIS and innovative information technologies in organizations.
2. P02 Demonstrate autonomy and responsibility in managing MIS projects and improving organizational processes
3. P03 Demonstrate comprehensive understanding of appropriate enterprise frameworks, theories from the MIS to research and assess contemporary issues in the field and related allied fields and disciplines
4. P04 Apply MIS knowledge to facilitate the acquisition, development, deployment, and management of information systems
5. P05 Apply MIS knowledge to the exploitation of opportunities created by information technology innovations ensuring the alignment between MIS strategy and organizational strategy
6. P06 Demonstrate ethical reasoning in relation to crucial MIS issues such as privacy, information security, and ethical use of information
7. P07 Apply appropriate technologies and techniques to the collection and analysis of organizational and environmental data to facilitate evidence-based decision-making
8. P08 Analyse organizational data to accurately identify organizational problems and propose solutions using MIS
9. P09 Apply effective communication skills consistent with the professional environment
10. P10 Apply effective collaboration skills consistent with the professional environment

Po-Lo Matrix