1. Demonstrate knowledge and understanding of methods and procedures used within forensic computing Knowledge & Understanding
Learning

2. Demonstrate an understanding of the tools used within forensic computing
Knowledge & Understanding

3. Present, evaluate and interpret forensically significant data
Analysis, Communication, Problem Solving

4. Identify areas where electronic evidence may be gathered, and its relevance to an investigation
Enquiry, Problem Solving, Reflection

A class test based upon knowledge acquired during lectures and tutorials. Covers Learning Outcomes 1, 3 & 4.
35% 2000 words

Group case study based upon an "evidence seizure" scenario. Pre-prepared evidence will be presented to each group, who will be aligned with either 'prosecution' or 'defence'. Each group will be required to present their interpretation of the evidence within a courtroom type setting. Covers Learning Outcomes 1, 2, 3, & 4 50% 6000 words

Casebook. You will be presented with a Casebook at the start of the module and will be required to maintain a log of activities, procedure notes and other relevant notes. Covers Learning Outcomes 1 and 2.
15% 1000 words

Knowledge and Understanding will be assessed through a class test. A casebook will be kept throughout the module to act as an aide memoire for this. There is a group case study assignment geared around meeting learning outcomes practically. The case study will reference the learners own work context where possible.

The focus of this module is to introduce the student to the knowledge and practical skills required of a Digital Investigator. To this end, a variety of topics will be introduced for development in future modules. The module will introduce the main concepts of Forensic Computing such as evidence seizure and collection, key technical concepts and crime scene management and processing. Several forensic tools will be used to begin to develop analytical skills, such as EnCase, FTK Imager, XRY.

Main topic areas covered:

Standards, Foundations and concepts of Digital Forensics
Evidence Collection Seizure and Crime Scene Processing
Evidence Acquisition Processing and Data Analysis
Mobile Device Forensics
Computers, hardware and networks
Operating Systems and file handling system Artefacts

Module Launch (30 hours)
There will be a module launch during which around 20 hours of face to face contact will be devoted to undertaking tasks which are designed to provide useful insights into the module content and purpose. The remaining time will be spent on guided learning activities.

Additional Guided Learning (22 hours)
A module tutor who is part of the teaching team of the module will be allocated to you and you will meet them during the launch. Following the launch, there will be some materials on the VLE which are designed to guide your learning. Additionally, there will be at least two hour long sessions per week of contact time for the eleven weeks following the launch. This will be used for learning guided led by your module tutor. It will be a face to face presentation if you are on day release. For online learners it will be flipped classroom approach with group (up to 20) seminars.

Reviews:
(1 hour per student)

Independent learning (247 hours)
The module leader will provide resources through the virtual learning environment which will include videos and presentations as well as links to useful websites. Other academic learning will be achieved through reading around the subject area. Module tutors will suggest useful texts, though many others will be suitable and can be found in our e-library. If you require help understanding any of the concepts, you may contact your module tutor for assistance.

Part of your independent learning will take place in your workplace under the guidance of your mentor. You will complete a work-based learning agreement to ensure that arrangements are in place at your workplace to facilitate this work-based learning. You are encouraged to endeavour to apply your growing academic knowledge to improve your work practice and to reflect on your work-based experiences to improve your learning.

You will be required to complete assignment work during independent learning time. Assignment work for a 30 credit module at level 6 should take around 120 hours to complete

Additional help with learning
You will have access to the departmental librarian. As a student, you are more than welcome to visit the university at any time and to use the resources. During time at the university, you may arrange to meet your module tutor or academic coach for additional help

Solomon, M. (2011). Computer Forensics Jumpstart. 2nd ed. Indianapolis, IN: Wiley. ISBN 978-0-470-93166-0

Data Protection Act 2018 and GDPR 2018 ISO/IEC/IEEE 29148:2011

ISO 8000-8:2015 Data quality -- Part 8: Information and data quality: Concepts and measuring

Mandia K, Pepe M and Luttgens J T (2018) Hands On Incident Response and Digital Forensics BCS Learning & Development Limited ISBN 1787285391

Specialised hardware and software located within the Forensic & Security lab