Digital Forensics (CS 6963) Polytechnic University. Brooklyn, New York

Transcription

1 Digital Forensics (CS 6963) Polytechnic University Brooklyn, New York Instructor: Name: Walter Bruehs Blackberry Phone: Office: / Blackberry: Office Hours: By Arrangement Course Description: This course will introduce information technology professionals with the application of forensic science principles and practices to the collection, preservation, examination, analysis and presentation of digital evidence. The course will include selected topics from the legal, forensic, and information technology domains and utilize lecture, laboratory and written projects to illustrate these topics. Instructional Methods: This course will use a combination of lecture, discussions, laboratory exercises and individual research in order to develop the student s understanding and application of digital forensics.

2 Each week, students will listen to a lecture posted on epoly. Most weeks will also have discussion questions posed either in the lecture or on the week s home page. Additional laboratory sessions will be held using a virtual lab and laboratory reports, in the designated format, are required deliverables. epoly: Poly uses a Web-based teaching and learning environment called epoly. Access to epoly is available at the following URL: This course is designed for high bandwidth. Students are strongly advised to utilize only broadband connections when using the epoly site. Student computers must support Flash animation. Course Conduct and Academic Honesty: The academic community of Polytechnic University and of the profession of digital forensics require the highest standards of professional ethics and personal integrity from all members of the community. Violations of these standards are violations of a mutual obligation characterized by trust, honesty, and personal honor. As a community, we commit ourselves to standards of academic conduct, impose sanctions against those who violate these standards, and keep appropriate records of violations. The Polytechnic University Policy on Academic Dishonesty can be found at:

3 Students with Disabilities: Students who need special consideration because of any sort of disability should notify the instructor at the start of the course, and any time thereafter if further consideration is needed. Course Objectives: At the completion of this class, students will: 1. Have an understanding of the fundamental concepts of forensic science. 2. Have a basic understanding of the application of forensic science principles to digital evidence examinations. 3. Be able to articulate the steps of the forensic process as applied to digital evidence. 4. Be able to draft a Standard Operating Procedure. 5. Conduct rudimentary digital forensic examinations. 6. Recognize the application of digital forensics with respect to information security. Course Materials: Required text: Brian Carrier. File System Forensic Analysis. Addison Wesley, (ISBN: ) Recommended texts:

4 George Mohay, et al. Computer and Intrusion Forensics. Artech House, (ISBN: ) Eoghan Casey. Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet. Sammes, Tony, Jenkinson, Brian; Forensic Computing; Springer-Verlag, Ltd.; 2000 (ISBN ) Web Sites: Students are responsible for reading the material contained in the hyperlinks noted in the course syllabus. The following sites are for background information: Course Requirements: The following are required deliverables: 1. Student Biography (including photograph of student) due by end of Unit 1 2. Discussion questions as assigned (approximately 4 due at the end of Units 2, 3, 6, and 8) to be submitted in the Discussion Area.

5 3. Two quizzes (Unit 4 and Unit 9) 4. Laboratory Reports (Units 2, 4, 5, 6, 7, and Final) 5. Standard Operating Procedure (Unit 3) 6. Forensic Examination Plan (Unit 10) IMPORTANT NOTE: The instructor may add, remove or modify requirements during the course. Students must read all postings on the epoly website. Grading Policy: Students will be graded on the following course requirements: Online Discussion Participation 10 points Laboratory Examinations 30 points Standard Operating Procedure 15 points Examination Plan 15 points Trial Exhibit 10 Quizzes (2) - 20 Course final grades will be assigned as follows: A A B B B , C C C D F <59

6 Tentative Class Schedule Unit 1 9/07/10 Unit 2 9/13/10 Unit 3 9/20/10 Unit 4 9/27/10 Unit 5 10/04/10 Unit 6 Lecture Welcome Introduction to Forensic Science & The Scientific Method Evidence Handling, Quality Assurance and SOP s Hierarchy of Access and The Digital Forensic Process Documentation and Report Writing Legal One Constitutional Law Class Topics Assignments Post Student Bios on epoly Chapters 2,4 Carrier Chapters 1, Carrier Ch 4 & 5, 10 Carrier Ch. 3 Quiz 1 "Carrier Ch. 9 U.S. Constitution (

7 10/11/10 Amendments 1, 4, 5, 6 & 7 " Unit 7 10/18/10 Legal Two Criminal/Civil Procedure Unit 8 10/25/10 Unit 9 11/01/10 Unit 10 Forensic Tool Selection & Use Examination Planning & Design Evidence Law Carrier Appendix A Begin Final Examination 11/08/10 11/22/10 Fall Recess Unit 11 Findings and Conclusions Quiz 2 11/15/10 Unit 12 11/29/10 Testimony & Exhibits Maltese, Expert Testimony: (on epoly) Judge and Attorney Experiences, Practices, and Concerns Regarding Expert Testimony in Federal Civil Trials Carol Krafka; Meghan A. Dunn; Molly Treadway Johnson; Joe

8 Unit 13 Roles and Responsibilities S. Cecil; Dean Miletich 2002, 24 pages ( Final Examination Due 11:59 PM ET December 10, /06/10 Unit 14 12/13/10 No Lecture Trial Exhibit Due 11:59 PM ET December 17, 2010 Course Evaluation and wrap-up