Module Descriptors
INTRODUCTION TO DIGITAL INVESTIGATION
COCS40589
Key Facts
Faculty of Computing, Engineering and Sciences
Level 4
30 credits
Contact
Leader: Rob Shaw
Email: R.Shaw@staffs.ac.uk
Hours of Study
Scheduled Learning and Teaching Activities: 72
Independent Study Hours: 228
Total Learning Hours: 300
Assessment
- TEST weighted at 80%
- CASE BASED STUDY weighted at 20%
Module Details
Module Resources
Specialised hardware and software located within the Forensic & Security lab
Module Texts
Computer Forensics JumpStart, 2nd Edn, Michael G. Solomon M.G. et al, 2011, ISBN 978-0-470-93166-0
Module Learning Strategies
24 hours of lectures and 48 hours of practical/tutorial sessions.
The focus will be problem led learning using practical tasks and case study scenarios supported by theoretical underpinning delivered in a lecture.
You will also be required to undertake background / directed reading to support the material delivered during lectures and to support / enhance the work undertaken during the practical sessions.
It is envisaged that a practical "evidence seizure" session will be held based upon a crime scenario which will be used as a case study for the group assignment.
The focus will be problem led learning using practical tasks and case study scenarios supported by theoretical underpinning delivered in a lecture.
You will also be required to undertake background / directed reading to support the material delivered during lectures and to support / enhance the work undertaken during the practical sessions.
It is envisaged that a practical "evidence seizure" session will be held based upon a crime scenario which will be used as a case study for the group assignment.
Module Additional Assessment Details
TESTS - weighted at 50% - a series of 2 class tests (1 hour each). Learning outcomes 1 and 2.
Group case study - weighted at 35%. Learning outcomes 2-4
The class tests will be based upon knowledge acquired during lectures and tutorials. The group-work assignment will be based upon an "evidence seizure" scenario. Pre-prepared evidence will be presented to each group, who will be aligned with either `prosecution¿ or ¿defence¿. Each group will be required to present their interpretation of the evidence within a courtroom type setting.
Casebook (weighted at 20%) - you will be presented with a Casebook at the start of the module and will be required to maintain a log of activities, procedure notes and other relevant notes. This will be assessed at the end of the semester for a total of 15% of the overall assessment mark. This is the final assessment.
Group case study - weighted at 35%. Learning outcomes 2-4
The class tests will be based upon knowledge acquired during lectures and tutorials. The group-work assignment will be based upon an "evidence seizure" scenario. Pre-prepared evidence will be presented to each group, who will be aligned with either `prosecution¿ or ¿defence¿. Each group will be required to present their interpretation of the evidence within a courtroom type setting.
Casebook (weighted at 20%) - you will be presented with a Casebook at the start of the module and will be required to maintain a log of activities, procedure notes and other relevant notes. This will be assessed at the end of the semester for a total of 15% of the overall assessment mark. This is the final assessment.
Module Indicative Content
This module explicitly focuses on significant elements required for the achievement of the STAFFORDSHIRE GRADUATE ATTRIBUTES.
ACPO & other guidelines
Use of Windows/Unix/Linux based investigation tools
Stages of an e-Investigation
Digital storage analysis
Evidence seizure
Evidence reporting
The Need for Computer Forensics.
Preparation - What to Do Before You Start.
Computer Evidence.
Common Tasks.
Capturing the Data Image.
Extracting Information from Data.
Passwords and Encryption.
Common Forensic Tools.
Pulling It All Together.
How to Testify in Court.
Digital Investigation as a business - Private vs Public
ACPO & other guidelines
Use of Windows/Unix/Linux based investigation tools
Stages of an e-Investigation
Digital storage analysis
Evidence seizure
Evidence reporting
The Need for Computer Forensics.
Preparation - What to Do Before You Start.
Computer Evidence.
Common Tasks.
Capturing the Data Image.
Extracting Information from Data.
Passwords and Encryption.
Common Forensic Tools.
Pulling It All Together.
How to Testify in Court.
Digital Investigation as a business - Private vs Public
Module Special Admissions Requirements
None.