CS 672 - Digital Forensics

Prerequisites
CS 662, CS 663, and CS 665

This course presents an overview of the principles and practices of digital investigation. The objective of this class is to emphasize the fundamentals and importance of digital forensics. Students will learn different techniques and procedures that enable them to perform a digital investigation. This course focuses mainly on the analysis of physical storage media and volume analysis. It covers the major phases of digital investigation such as preservation, analysis and acquisition of artifacts that reside in hard disks and random access memory. Students explore tools for the recovery of information on protected or damaged hardware for the purpose of providing evidence of misuse or abuse of systems. Topics also include the chain of evidence, protocols for data recovery, cryptographic analysis, password recovery, the bypassing of specific target operating systems, and obtaining data from digital devices that have been damaged or destroyed. Principles of defendant rights and ethical investigation are also discussed in detail.

Course credits: 3