Spring Department of Marketing & Information Systems Richard J. Wehle School of Business Canisius College

Transcription

1 Department of Marketing & Information Systems Richard J. Wehle School of Business Canisius College Spring 2014 MSF 704, MBA 602, ISB 460 Computer Forensics Syllabus PROFESSOR: Dr. L. Volonino, CISSP, ACFE OFFICE: Tower 504 OFFICE TEL: OFFICE HOURS: prior or after class in Tower 504 and by appointment COMMUNICATION: All communication during the semester with the instructor is via the designated Angel Discussion Forum, in class, and in-office only. Do not send CANISIUS COLLEGE POLICIES Academic Calendar: Academic Integrity Policy: DSS: If you have any condition which will make it difficult for you to carry out the course work or which will require extra time on examinations, please notify me in the first two weeks of the course so that we may make appropriate arrangements. 2. COURSE DESCRIPTION Welcome to the world of electronic evidence (e-evidence) investigations using computer forensics, mobile forensics, and social forensics tools according to legal procedures in order to reconstruct what happened. The types and volumes of e-evidence continue to expand driven to a large extent by mobile devices, social media, machine-to-machine (M2M) communication, near-field communication (NFC), location-aware devices, and big data. You learn how to conduct computer, mobile, and social forensics investigations; interpret the e-evidence; make inferences; write defensible reports to be used in legal actions; and testify as an expert witness. In lab sessions, you get hands-on training in the use of the FTK (Forensics ToolKit) software to recover, search, and analyze e-evidence and create reports. 3. REQUIRED TEXTBOOKS & SUPPLIES Volonino, Anzaldua & Godwin, Computer Forensics: Principles and Practices, ISBN: Computer Forensics For Dummies notebook for taking notes 10 CDs and 2 flash drives Courseware: Check Angel frequently for announcements, grades, and course updates. 1

2 4. GRADING POLICY Category Coursework Team Presentation Midterm Exam Final Exam Weight and credits 45% credits 10% credits 20% credits 25% credits Final Course Grades (prior to adjustments based on attendance) Course Grade levels credits A >= 92 A- >= 90 B+ >= 87 B >= 83 B- >= 80 C+ >= 78 C >= 76 C- >= 74 D >= 72 F < COURSE POLICIES, & ACADEMIC AND ETHICAL STANDARDS 1. To be fair to all students and maintain academic standards, there are no exceptions to the course syllabus except possibly in extraordinary situations approved by the college. 2. Transparency and accountability underlie all policies for this course. To avoid attempts for special (sub-standard) treatment, all course-related communication is transparent via the Discussion Forum on Angel. Do not send . For personal issues, meet with me in person. 3. Attendance is mandatory. Up to 1 missed class or part of a class will be excused without a negative impact on your final grade. Each additional missed class or part of a class will reduce the final grade by one level. Anyone missing more than 3 classes or parts of classes, including cyber sessions, will not pass the course. Plan accordingly because there are no exceptions. 4. Attendance, professional conduct, integrity, respect for others, and personal responsibility are mandatory. 5. To receive credit for coursework, submit by the deadline. Coursework submitted after the deadline does not receive credit. Missed in-class assignments do not receive credit. 6. Individual work must be done sufficiently independently. If one, two or more students or teams submit work that appears not to have been prepared or performed independently to a sufficient degree, students receive a zero grade and may be removed from the course. 2

3 7. Proper grammar, spelling, punctuation, sentence structure, capitalization, and formatting are required for all coursework, exams, and presentations. 8. Keep a digital copy and a hardcopy of all your work for as long as it might be needed. 9. Check the gradebook on Angel frequently. If a grade is incorrectly recorded, bring the graded paper to me so I can correct your grade. Do so by the last class session. 10. If you disagree with a grade that you received on homework or other, you must do so within two weeks of the date the work was returned or by the last class session, whichever is first. 11. Enter the Attendance PIN at the beginning of class. Verify that you have entered the PIN correctly. 12. Bring the books to each class. 13. Exams are open book and open notebook. Bring your books and notebook to the midterm and final exam. Books and notebooks cannot be shared during exams. 14. Filename format to use for Word files: Lastname-Firstname-CF-description.docx Here is an example: Claus-Santa-CF-HW1.docx Note: There are no spaces in the filename and only 1 extension. Additional directions will be given in class and/or posted on Angel. 3

4 5. Course Schedule. Changes may be necessary. Check Angel often. Computer Forensics Principles & Practices (CFPP) Computer Forensics For Dummies (CFFD) Week # Dates shown are Sundays #1 Jan 12 Chapters to read prior to class Links to articles, recent cases involving electronic evidence, and other online content to read or view in preparation for class are posted in each Week s folder on Angel Introduction to the 3 dimensions of computer forensics: Legal, technological, and investigative Discussion of current investigations involving e-evidence: GWB scandal in NJ Deadlines & Presentation Dates Details are discussed in class and posted on Angel. There are in-class assignments throughout the semester. #2 Jan 19 CFPP: Preface and Chapter 1 Admissibility of e-evidence Computer forensics, e-evidence, and crime investigation CFFD: Introduction #3 Jan 26 CFPP: Chapters 2 & 12 Computer forensics and digital detective work Federal Rules and Criminal Codes CFFD: Chapter 1 What digital devices create & store #4 Feb 2 CFPP: Chapter 3 Preparing for E-Evidence Collection and Preservation Tools, Environments, Equipment, and Certifications CFFD: Chapter 2 Suiting up for lawsuits or criminal investigations Homework #1 4

5 #5 Feb 9 CFPP: Chapter 4 Policies and Procedures CFFD: Chapter 3 Getting authorized to search and seize Presentations by Teams 1, 2 #6 Feb 16 #7 Feb 23 Tues, 2/18 no class President s Holiday CFPP: Chapter 8 forensics CFFD: Chapter 4 Documenting & managing the crime scene Homework #2 #8 March 2 CFPP: Chapter 9 Detecting Intrusions, Malware, & Fraud Internet and Network Forensics and Intrusion Detection CFFD: Chapter 5 Minding & finding legal loopholes Presentations by Teams 3, 4 #9 Midterm March 9 Spring break the Week of March 16 #10 March 23 #11 March 30 CFPP: Chapter 11 Fraud and Forensic Accounting Investigation CFFD: Chapter 6 Acquiring and authenticating e-evidence Homework #3 Presentation by Team 5, 6 Presentation by Teams 7, 8 5

6 #12 April 6 CFFD: Chapters 10 Data forensics #13 April 13 CFPP: Chapter 13 Ethical and Professional Responsibility in Testimony Presentations by Teams 9, 10 #14 April 20 CFFD: Chapters 15, 16, & 17 Holding up your end at pretrial Winning a case before you go to court Standing your ground in court Homework #4 Presentations by Teams 11, 12 #15 April 27 CFFD: Chapters 15, 16, & 17 (cont d) Holding up your end at pretrial Winning a case before you go to court Standing your ground in court Presentations by Teams 13, 14, 15 May 4 Final exam as scheduled by the registrar 6