1. IDENTIFY APPROPRIATE METHODS AND PROCEDURES FOR THE EXTRACTION OF DATA AND THE ANALYSIS OF EVIDENCE.
Enquiry, Analysis, Problem Solving,

2. UNDERSTAND THE LEGAL FRAMEWORK WITHIN WHICH A FORENSIC ANALYST WORKS AND HOW THIS MAY IMPACT ON PROCEDURES USED.
Knowledge and Understanding, Learning

3. PRODUCE DETAILED REPORTS BASED ON CASE INVESTIGATION THAT ARE IN A FORMAT ABLE TO BE PRESENTED IN A LEGAL ENVIRONMENT.
Communication, Reflection

4. DEMONSTRATE ENHANCED PRACTICAL SKILLS BASED ON THOSE SKILLS LEARNED EARLIER. Application

5. EVALUATE THE INTERACTION OF FILE SYSTEM COMPONENTS, THE RESIDENT DATA AND THE INTERPRETATION OF THE DIGITAL EXAMINATION TOOLS.
Enquiry, Analysis

Student portfolio assignment that covers all learning outcomes.
The portfolio will be completed individually and will involve the student developing artefacts and research formatively assessed throughout both Semesters. The assignment will be based on a case study or series of case studies to provide a real-world focus to the students work (Learning Outcomes 1 to 5).

The focus of this module is to build on and enhance critical practical skills and analytical thinking developed earlier on the course. Advanced analytical techniques and procedures will be taught using EnCase as the primary analysis tool. Training in mobile forensic analysis using Cellebrite UFED is embedded in the module and certification will be offered.

An overview of case management techniques and the impact of the law and presenting information within a legal environment will be given. This legal environment will be focussed on UK law, but an overview and understanding of International law will be covered.

Main topic areas covered:

The national and international legal systems, including jurisdiction
The international aspects of cybercrime and cyberwar
Enhanced practical skill development using EnCase – on the path to enhanced certification
Enhanced practical skill development using Cellebrite UFED – certification offered
Case management from inception to court presentation

You will be required to complete background reading prior to each lecture / tutorial. The background reading will help underpin the practical demonstrations. A large proportion of the tutorial sessions will be problem based. Students will be given case studies and content to work through in trying to solve problems.

Where appropriate you will be given formative assessment to complete and evaluate with peers

Carvey, H., (2009). Windows Forensic Analysis DVD Toolkit. Elsevier Science. ISBN: 9781597494229
Data Protection Act 2018 and GDPR 2018 ISO/IEC/IEEE 29148:2011
Good Practice Guide for Computer based evidence, Association of Chief Police Officers (ACPO) of England, Wales and Northern Ireland
ISO 8000-8:2015 Data quality -- Part 8: Information and data quality: Concepts and measuring
Johansen, G. (2017). Digital Forensics and Incident Response. Packt Publishing. ISBN13: 978-1787288683
Ligh, M. (2014). The art of memory forensics. Indianapolis, Ind.: Wiley.
Nelson, B., Phillips, A. and Steuart, C. (2013). Guide to computer forensics and investigations. Boston: Course Technology. ISBN: 1435498836
Nikkel, B., (2016). Practical Forensic Imaging: Securing Digital Evidence with Linux Tools. No Starch Press. ISBN-13:
978-1-59327-793-2
Sammes, A. and Jenkinson, B. (2010). Forensic computing: A Practitioners Guide. 2nd edn. London: Springer. ISBN: 184996596

Access to a forensics / security Lab.
Access to Virtual Machines
Forensic Analysis software such as EnCase, FTK.
Access to digital forensic hardware (Fastblock writeblocking kits).
Access to exhibits (hard drives and images prepared by tutor).

None