Module Descriptors
DIGITAL FORENSICS - SYSTEMS
COCS50685
Key Facts
Digital, Technology, Innovation and Business
Level 5
30 credits
Contact
Leader: Christopher Howard
Email: C.Howard@staffs.ac.uk
Hours of Study
Scheduled Learning and Teaching Activities: 78
Independent Study Hours: 222
Total Learning Hours: 300
Assessment
- COURSEWORK weighted at 100%
Module Details
Module Resources
Specialised hardware and software located within the Forensic & Security lab
Module Texts
Operating System Concepts, 9th Edition International Student Version, Silberschatz, A, Galvin, P., Gagne, G., 2013. Wiley. ISBN: 978-1-1180-9375-7
File System Forensic Analysis, Carrier, B., Addison-Wesley, 2005. ISBN 0-321-26817-2
Computer Forensics and Investigations 2nd Ed, Nelson, Philips, Enfinger & Stuart, 2006, Thompson. ISBN 0-619-21706-5
Operating Systems: Internals and Design Principles, Stallings, W., Prentice Hall, 2004, ISBN 0-131-27837-1
Operating Systems with Linux, OżGorman, J., Palgrave Macmillan, 2001, ISBN 0333947452
Operating Systems, OżGorman, J., Palgrave Macmillan, 2000, ISBN 0-333-80288-8
File System Forensic Analysis, Carrier, B., Addison-Wesley, 2005. ISBN 0-321-26817-2
Computer Forensics and Investigations 2nd Ed, Nelson, Philips, Enfinger & Stuart, 2006, Thompson. ISBN 0-619-21706-5
Operating Systems: Internals and Design Principles, Stallings, W., Prentice Hall, 2004, ISBN 0-131-27837-1
Operating Systems with Linux, OżGorman, J., Palgrave Macmillan, 2001, ISBN 0333947452
Operating Systems, OżGorman, J., Palgrave Macmillan, 2000, ISBN 0-333-80288-8
Module Additional Assessment Details
100% course work that will consist of three elements.
1. A written element that will assess Learning Outcomes 4 & 5. This will be a report based upon a review of encryption techniques and their effect on systems and forensic investigations. Weighting 40%. This will be the first item to be submitted.
2. A practical based element that will assess Learning Outcomes 1, 2 & 3. This will be based around a contrived scenario for an investigation, using an image provided for the assignment. Weighting 45%.
3. You will be presented with a Casebook at the start of the module and will be required to maintain a log of activities, procedure notes and other relevant notes. This will be assessed at the end of the semester for a total of 15% of the overall assessment mark. Learning outcome 1-3, This will be the final tem to be submitted.
1. A written element that will assess Learning Outcomes 4 & 5. This will be a report based upon a review of encryption techniques and their effect on systems and forensic investigations. Weighting 40%. This will be the first item to be submitted.
2. A practical based element that will assess Learning Outcomes 1, 2 & 3. This will be based around a contrived scenario for an investigation, using an image provided for the assignment. Weighting 45%.
3. You will be presented with a Casebook at the start of the module and will be required to maintain a log of activities, procedure notes and other relevant notes. This will be assessed at the end of the semester for a total of 15% of the overall assessment mark. Learning outcome 1-3, This will be the final tem to be submitted.
Module Indicative Content
This module explicitly focuses on significant elements required for the achievement of STAFFORDSHIRE GRADUATE ATTRIBUTES.
The investigation and analyses of various operating systems such Linux, IOS and Windows,
Analysing a variety of file handling systems such as FAT & NTFS file systems, data recovery methods and Chaining.
Bit locking, encryption and tamper resistant storage.
File formats, headers, checksums, HTML & e-mail files.
Operating system functionality and its impact upon evidence gathering
Access controls and encryption
Recovery of digital evidence: Methods and Procedures
Standards for evidence handling e.g. ISO 17799
Network activity monitoring and tracing
Risk analysis
Evaluation and reporting of evidence
The investigation and analyses of various operating systems such Linux, IOS and Windows,
Analysing a variety of file handling systems such as FAT & NTFS file systems, data recovery methods and Chaining.
Bit locking, encryption and tamper resistant storage.
File formats, headers, checksums, HTML & e-mail files.
Operating system functionality and its impact upon evidence gathering
Access controls and encryption
Recovery of digital evidence: Methods and Procedures
Standards for evidence handling e.g. ISO 17799
Network activity monitoring and tracing
Risk analysis
Evaluation and reporting of evidence
Module Special Admissions Requirements
Prior study of a level 4 30 credit Network/Forensic/Security Module
Module Learning Strategies
52 hours of lectures and 26 hours of practical/tutorial sessions The focus will be problem led learning using practical tasks and case study scenarios supported by theoretical underpinning delivered in a lecture. You will also be required to undertake background / directed reading to support the material delivered during lectures and to support / enhance the work undertaken during the practical sessions.