Module Descriptors
CYBERCRIME FORENSIC ANALYSIS
COCS70381
Key Facts
Faculty of Computing, Engineering and Sciences
Level 7
15 credits
Hours of Study
Scheduled Learning and Teaching Activities: 36
Independent Study Hours: 114
Total Learning Hours: 150
Assessment
- ASSIGNMENT weighted at 50%
- EXAMINATION - UNSEEN IN EXAMINATION CONDITIONS weighted at 50%
Module Details
Module Texts
Carvey H, Windows Forensics Analysis, Syngress, 2009, ISBN: 978-1-59749-9
Nelson B, A. Phillips, et. al, Guide to Computer Forensics and Investigations, 2010, Thompson, ISBN: 1435498836
Sammes T, B. Jenkinson, Forensic Computing: A Practitioners Guide, Second Edition, 2010, Springer-Verlag, ISBN: 184996596X
Carvey, H, Windows Forensic Analysis DVD Toolkit 2nd Edition, Syngress, 2010, ISBN: 9781597494229
Nelson B, A. Phillips, et. al, Guide to Computer Forensics and Investigations, 2010, Thompson, ISBN: 1435498836
Sammes T, B. Jenkinson, Forensic Computing: A Practitioners Guide, Second Edition, 2010, Springer-Verlag, ISBN: 184996596X
Carvey, H, Windows Forensic Analysis DVD Toolkit 2nd Edition, Syngress, 2010, ISBN: 9781597494229
Module Resources
Access to the Digital Forensic Lab,
Digital Forensics Software (EnCase, FTK, NetAnalysis)
Sanitized cases accumulated by the Faculty
Digital Forensics Software (EnCase, FTK, NetAnalysis)
Sanitized cases accumulated by the Faculty
Module Special Admissions Requirements
Prior study of CE01231-7 Digital Forensic Fundamentals or equivalent.
Module Indicative Content
This module covers the main aspects and concepts of forensic computing considering the topic in relation to individual and networked computer systems. In particular it will address:
- An overview and introduction ACPO guidelines
- How to prepare a forensically sound computer image for examination
- Maintaining a chain of custody and proper documentation prior to digital examination
- Digital Forensic Examination of desktop and laptop computers running windows based operating systems
- The structure of Windows XP and Windows 7
- Logical areas and where to recover user related artefact
- The structure of the registry
- Encryption techniques and methodologies
- Cryptography methods and techniques
- An overview and introduction ACPO guidelines
- How to prepare a forensically sound computer image for examination
- Maintaining a chain of custody and proper documentation prior to digital examination
- Digital Forensic Examination of desktop and laptop computers running windows based operating systems
- The structure of Windows XP and Windows 7
- Logical areas and where to recover user related artefact
- The structure of the registry
- Encryption techniques and methodologies
- Cryptography methods and techniques
Module Learning Strategies
The material will be presented through a combination of lectures, tutorials, practical exercises and directed self-study.
Teaching is in the form of 1 lecture and 2 tutorial sessions per week. The lecture and the tutorial sessions could be combined to form a 3 hour teaching session.
(1:n)1 (1:20)2
Teaching is in the form of 1 lecture and 2 tutorial sessions per week. The lecture and the tutorial sessions could be combined to form a 3 hour teaching session.
(1:n)1 (1:20)2
Module Additional Assessment Details
An assignment length 1500 words weighted at 50% (Learning Outcomes 1, 2, 3 )
2 hour Exam weighted at 50% (Learning Outcomes 1, 2, 3, 4)
2 hour Exam weighted at 50% (Learning Outcomes 1, 2, 3, 4)