XXXX Computer Forensics

Instructional Hours: 42 Hours

Course Purpose
The purpose of this course is to equip learners with both the principles and the practices of
computer forensics. It is aimed at providing the learner with hands-on experience on how to
uncover illegal or illicit activities left on computer storage media and recovery files using various
forensic tools and techniques.

Expected Learning Outcomes

At the end of this course learner shall be able to:
(i) Describe digital forensics and relate it to an investigative process.
(ii) Explain the legal issues of preparing for and performing digital forensic analysis
(iii) Describe the role of digital forensics in public and private investigations.
(iv) Demonstrate use of digital forensics tools.
(v) Guide a digital forensics exercise.

Course Description
Introduction to Computer Forensics: concepts of computer forensic science, legal issues,
context, and digital forensics; computer crimes, évidence, extraction, preservation.
Media, Network and Code forensics : hardware and operating systems: structure of storage
media/devices, disk structure, file systems (NTFS, EXT 2/3, HFS), and physical layer issues,
defend against software targets for viruses, worms, hostile codes and other malware, identifying
hostile codes-buffer overflow, provision of unexpected inputs
Data Recovery: Identifying hidden data, Encryption/Decryption, Hash functions,
Message Authentication Code, Steganography, recovering deleted files, identifying forged
images etc
Digital evidence controls: Data acquisition, disk imaging, recovering swap files, temporary
&cache files, memory forensic.. Data Erasers, File & Disk Lockers (Demonstration of Various
Computer Forensic tools by students- - Computer Forensic tools: TBD)
Network and Mobile forensics: Collecting and analysing network-based evidence,
reconstructing web browsing, cyber forensics, e-mail activity, and windows registry
changes, intrusion detection, tracking offenders, mobile network architecture
Computer forensics in public and private investigations: role, procedures;Computer crime
and Legal issues: Intellectual property, privacy issues, Criminal Justice system for forensic,
audit/investigative situations and digital crime scene, investigative procedure/standards for
extraction, preservation, and deposition of legal evidence in a court of law. Tools
Memory Forensic: Memory Dump Formats. Tools, Linux Memory Extractor (LiME), Registry Analysis,
dump password hashes ,LSA Secrets

Teaching Methodologies
Face-to-Face Lectures, Case Studies, Seminars, Presentations and Discussions.

Instructional Materials/Equipment
Computers, Internet and Programming Software.

Course Assessment
Continuous Assessment Tests – 50%
End of semester Examinations- 50%
Total – 100%

Core Texts
Digital Forensics Explained, Greg Gogolin (2013). The practice of network security monitoring:
understanding incident detection and response. No Starch Press.
Guide to Computer Forensics and Investigations (4th edition). By B. Nelson, A. Phillips, F.
Enfinger, C. Steuart. ISBN 0-619-21706-5, Thomson, 2009.
Computer Forensics Investigation Procedures and response, EC-Council Press, 2010

Journals
Journal of Digital Forensic Practice http://www.tandf.co.uk/15567281
The Journal of Digital Forensics, Security and Law http://www.jdfsl.org/