Module Descriptors
INTRODUCTION TO DIGITAL INVESTIGATION
COCS40655
Key Facts
Faculty of Computing, Engineering and Sciences
Level 4
30 credits
Contact
Leader: Rob Shaw
Email: R.Shaw@staffs.ac.uk
Hours of Study
Scheduled Learning and Teaching Activities: 72
Independent Study Hours: 228
Total Learning Hours: 300
Assessment
- TEST weighted at 85%
- CASE BASED STUDY weighted at 15%
Module Details
Module Additional Assessment Details
There will be a total of 2 x 1 hour class tests and a written group assignment based upon a case study. Together, these will form a total of 85% of the overall assessment mark.
All of the learning outcomes will be assessed over the class tests and assignment.
The class tests will be based upon knowledge acquired during lectures and tutorials. The group-work assignment will be based upon an "evidence seizure" scenario. Pre-prepared evidence will be presented to each group, who will be aligned with either 'prosecution' or 'defence'. Each group will be required to present their interpretation of the evidence within a courtroom type setting.
You will be presented with a Casebook at the start of the module and will be required to maintain a log of activities, procedure notes and other relevant notes. This will be assessed at the end of the semester for a total of 15% of the overall assessment mark.
All of the learning outcomes will be assessed over the class tests and assignment.
The class tests will be based upon knowledge acquired during lectures and tutorials. The group-work assignment will be based upon an "evidence seizure" scenario. Pre-prepared evidence will be presented to each group, who will be aligned with either 'prosecution' or 'defence'. Each group will be required to present their interpretation of the evidence within a courtroom type setting.
You will be presented with a Casebook at the start of the module and will be required to maintain a log of activities, procedure notes and other relevant notes. This will be assessed at the end of the semester for a total of 15% of the overall assessment mark.
Module Learning Strategies
24 hours of lectures and 48 hours of practical/tutorial sessions.
The focus will be problem led learning using practical tasks and case study scenarios supported by theoretical underpinning delivered in a lecture.
You will also be required to undertake background / directed reading to support the material delivered during lectures and to support / enhance the work undertaken during the practical sessions.
It is envisaged that a practical "evidence seizure" session will be held based upon a crime scenario which will be used as a case study for the group assignment.
The focus will be problem led learning using practical tasks and case study scenarios supported by theoretical underpinning delivered in a lecture.
You will also be required to undertake background / directed reading to support the material delivered during lectures and to support / enhance the work undertaken during the practical sessions.
It is envisaged that a practical "evidence seizure" session will be held based upon a crime scenario which will be used as a case study for the group assignment.
Module Texts
Computer Forensics JumpStart, 2nd Edn, Michael G. Solomon M.G. et al, 2011, ISBN 978-0-470-93166-0
Module Resources
Specialised hardware and software located within the Forensic & Security lab
Module Special Admissions Requirements
None.
Module Indicative Content
This module explicitly focuses on significant elements required for the achievement of the STAFFORDSHIRE GRADUATE ATTRIBUTES.
ACPO & other guidelines
Use of Windows/Unix/Linux based investigation tools
Stages of an e-Investigation
Digital storage analysis
Evidence seizure
Evidence reporting
The Need for Computer Forensics.
Preparation - What to Do Before You Start.
Computer Evidence.
Common Tasks.
Capturing the Data Image.
Extracting Information from Data.
Passwords and Encryption.
Common Forensic Tools.
Pulling It All Together.
How to Testify in Court.
Digital Investigation as a business - Private vs Public
ACPO & other guidelines
Use of Windows/Unix/Linux based investigation tools
Stages of an e-Investigation
Digital storage analysis
Evidence seizure
Evidence reporting
The Need for Computer Forensics.
Preparation - What to Do Before You Start.
Computer Evidence.
Common Tasks.
Capturing the Data Image.
Extracting Information from Data.
Passwords and Encryption.
Common Forensic Tools.
Pulling It All Together.
How to Testify in Court.
Digital Investigation as a business - Private vs Public