Coursework item 1 weighted at 40% covering learning outcome 1, comprsing a report (circa 2000 words).
Coursework item 2 (final) weighted at 60% covering learning outcomes 2, 3 and 4 comprising:-
- a report detailing a practical outcome (circa 2000 words)
- a presentation (20 minutes)

The module will cover the following topics:-
• History of forensics – development of forensics as a field
• History of digital forensics
• Types of Digital Forensics – Computer, Network, Mobile Device, Digital Image, Digital video/audio, Memory
• Role of digital forensics in law
o Legal decision making
o Role of the court
o Purpose of court proceedings and role of evidence
o Relevant Legislation (e.g. Computer Misuse Act)
• Evidence gathering principles
o Forensically safe collection and storage of evidence
¿ Chain of evidence and evidence handling
• Implementing digital forensics investigations
o Network forensics
o Workstation or server forensics
o Data forensics
o Forensic tools
o Investigation planning and safe practice
• Presenting findings for forensic investigations
o Presenting evidence in court
o Producing forensic reports

Access to specialist hardware and software

Previous study of:-

COCS40662 Introduction to Computer and Network Architectures or COCS40663 Introduction to Computer and Network Architectures (WBL) or equivalent

Operating System Concepts, 9th Edition International Student Version, Silberschatz, A, Galvin, P., Gagne, G., 2013. Wiley. ISBN: 978-1-1180-9375-7
Forensic Computing: A Practitioners Guide Second Edition, 2010, Sammes T, B. Jenkinson, Springer-Verlag, ISBN: 184996596
File System Forensic Analysis, Carrier, B., Addison-Wesley, 2007 (5th Ed). ISBN: 0-321-26817-2
Guide to Computer Forensics and Investigations (3rd Ed), Nelson, Phillips, Enfinger & Stuart, 2007, Thompson. ISBN: 0-619-21706-5
Information Technology Law, 6th Ed, Ian J. Lloyd, 2011, OUP Oxford, ISBN: 978-0199588749

1. Critically evaluate the role of digital forensics in modern legal process and the impact that current legislation has on forensic investigations. (Enquiry, Analysis, Reflection).
2. Demonstrate critical knowledge and understanding of tools, techniques and methods used in evidence gathering. (Knowledge and Understanding, Learning).
3. Demonstrate the practical skills required to identify and recover data using forensically sound techniques.
4. Analyse, interpret and present a trail of digital evidence in an acceptable format for legal proceedings. (Analysis, Problem Solving, Communication).

The contact time will be broken down as follows-
52 hours of lectures,used to deliver technical knowledge and academic concepts
52 hours of hands on sessions using specialist hardware and software for development of practical skills.
The course will usually be delivered over 13 or 26 weeks with 2 or 4 hours of lectures per week accompanied by a similar amount of practical sessions. However, other delivery patters will be suitable.