70250 Graduate Certificate in Digital Forensics

Transcription

1 70250 Graduate Certificate in Digital Forensics Course overview The certificate course was inspired by experienced practitioners working in academia and the field of Digital Forensics, who saw the benefits of providing an academic course that merged theoretical digital forensics with practical technical training using world best digital forensic technology. The Centre for Forensic Science recognises the increasing reliance on digital evidence in legal cases and a pressing need to develop courses to assist digital forensic practitioners acquire academic certification of excellence in the discipline. We have identified the requirement for specific training in all aspects of digital forensics that needs to incorporate the use of cutting-edge tools rather than those that are freely available and combine academic rigor with practical experience. The Centre for Forensic Science has established a project that involves providers of innovative digital forensic tools (Perlustro and Xtremeforensics) in establishing a course that would provide students with a university post-graduate qualification and certification in a digital forensic tool. This project has now been turned into a course to be offered in 2015 and we believe it to be unique. The key benefit is that it provides a means for IT professionals to gain the necessary skills, certifications and experience to provide digital forensic services in all areas where it is practiced. The course includes experiential training, which provides students with an enriched understanding of the discipline through forensic examinations of realistic crime simulations. The course is also intended to prepare those wishing to enter the discipline with sound foundation of theory and practical skills. Successful completion of the course demonstrates that students have achieved a standard of theoretical forensic knowledge in the discipline and proficiency in the applied use of advanced forensic tools and processes in the discipline. Career opportunities This course is intended to be of special interest to those students already in the workforce or who are seeking careers as: Police, law enforcement and government investigative bodies. Corporate investigators. Banking and business auditors. Security managers and investigators. IT security professionals. Taxation compliance investigators. Defence and Intelligence personnel. The legal fraternity and criminologists.

2 Admission requirements To be considered for admission to this course an applicant must have - A relevant Bachelor of Science with an average mark of at least 65 percent in the units equivalent to UWA's Level 3 units, OR Via industry admission pathway. Industry admission pathway include to include an interview with a selection panel and at least one of the following criteria: o (1) demonstrated experience/or interest in working within the law enforcement industry and working in settings and/or abilities to work with and manage people in a team environment; o (2) demonstrated ability to design and implement solutions to problems and needs in their industry that will be require submission of a Questionnaire. Course structure The certificate consists of four units and all these units may be undertaken online and require a reliable Internet connect to our secure server where course material, forensic tools and crime simulations are hosted. This is part of the flipped classroom strategy enabling students to access pre-recorded learning and workshop material to ensure a meaningful learning experience and feedback on their study progress. The structure and content of the units is set out below:

3 FNSC5508 Introduction to Forensic Science Content In this unit, principles of scientific investigation are introduced including the scientific method, hypothesis formulation and testing, scientific proof and peer review. Advanced law of expert evidence both in Australia and internationally, and jury advocacy with expert evidence, are explored. Crime scene investigation, physical evidence collection and preservation, and other areas of forensic expertise are introduced. Presentation of evidence including chain of custody, expert testimony and forensic report writing are emphasised. Legal and forensic practitioners are involved in the delivery of the unit and case histories are used as illustrations. The unit is taught from first principles. Lectures followed by small group exercises allow students to apply their learning in realistic investigative scenarios. Videos, presentations by students and role play is also used to reinforce the key concepts. Covering principles of scientific investigation, notably: The scientific method, hypothesis formulation and testing, scientific proof and peer review. Advanced law of expert evidence both in Australia and internationally, and jury advocacy with expert evidence. Crime scene investigation, physical evidence collection and preservation, and other areas of forensic expertise are introduced. Presentation of evidence including chain of custody, expert testimony and forensic report writing. Learning outcomes Students are able to (1) evaluate, analyse and interpret evidence derived from a range of forensic disciplines; (2) take account of the practical issues involved in collecting and processing evidence; (3) apply the knowledge gained within a legal framework so as to problem-solve and present a case within a forensic context; and (4) identify non-scientific approaches to forensic issues. Assessment This comprises (1) student presentations of case studies, designed to assess research ability and the application of learning in an investigative context; (2) a major essay designed to assess research ability and critical/analytical skills; and (3) a two-hour examination, with short essay and problem-style questions.

4 FNSC5617 Forensic and Information Technology (preliminary unit) Content This unit introduces the Digital Forensic environment outlining its growing importance and role in criminal and civil investigations. It describes the nature of digital evidence found in computer operating systems, file systems, storage systems, and communications media. Cyber risks and threats to information holdings are introduced and the implications this has on forensic practice to identify perpetrators and recover digital evidence is presented. Students gain awareness and understanding of information security governance, standards, ethics and legislation that requires the compliance of Digital Forensic practitioners. The unit delivers a theoretical understanding of the key principles of Digital Forensics and the key stages of examination: notably, forensic acquisition, preservation, identification, analysis, collation, and presentation of digital evidence. Students will undertake a preliminary digital forensic examination of a simulated crime scene using an advanced forensic tool to identify and recover evidence. Students will collate and analyse evidence and prepare an expert report outlining their examination and analysis of the evidence identified. Learning outcomes Students are expected to demonstrate an understanding of the following learning outcomes, which are directly aligned with core concepts and principles in Digital Forensics: 1. Describe how appropriate procedures are applied in the course of professional Digital Forensic practice. 2. Explain the nature of threat to digital information and the role and importance of Digital Forensic across various legal domains. 3. Understand and develop acceptance of governance standards and ethical standards in information security and Digital Forensic settings. 4. Explain the application of technical knowledge and appropriate procedures to Digital Forensic tasks. 5. Understand the importance of underlying technical knowledge in the Digital Forensics. 6. Understand how to assemble and construct scientific material in the appropriate format. 7. Describe the role of the Digital Forensic practitioner as an expert witness. 8. Identify and apply the correct style and format of writing in expert reports and statements. 9. Work individually with competence to solve Digital Forensic problems. This unit provides a theoretical and practical knowledge of evidence acquisition, analysis and presentation of digital information stored on computing devices and provides students with: A greater understanding of the complex nature of digital evidence vis-à-vis its admissibility and evidentiary weight in criminal cases.

5 Use of a sophisticated digital forensic tools (ILookIX) to recover digital evidence through a basic forensic examination of a simulated crime scene, involving locating, synthesising and analysing evidence and the compilation of an expert evidence report, based on the forensic examination, to demonstrate their interpretation of and justification for their findings. Assessment Assessable components comprise a continuous assessment protocol comprising four written quizzes on six of the main topics covered (10% each) and the preparation of an expert report on their forensic examination of a simulated digital crime scene (60%). (Forensic tools used ILookIX)

6 FNSC5506 Crime in the digital environment (Prerequisite - FNSC5617) Content This unit provides theoretical and practical knowledge of evidence acquisition, analysis and presentation of digital information stored on computing devices. Students gain a greater understanding of the complex nature of digital evidence vis-à-vis its admissibility and evidentiary weight in criminal cases. Commensurate with the theoretical learning experience, students use a sophisticated digital forensic tool to recover digital evidence. Basic forensic examinations of simulated crime scenes enables students to locate, synthesise and analyse evidence. Students undertake comprehensive evidence analysis of their examination of a forensic crime scene images. Compilation of an expert evidence report, based on their forensic examination, will allow students to demonstrate their interpretation of and justification for their findings. Learning outcomes Students are expected to demonstrate an understanding of the following learning outcomes, which are directly aligned with core concepts and principles in Digital Forensics: 1. Describe how appropriate processes are applied in the course of digital evidence acquisition and preservation. 2. Explain the application of technical knowledge and appropriate procedures to computer forensic tasks. 3. Understand how to assemble and construct scientific material in the appropriate format. 4. Gain further understanding and acceptance of governance standards and ethical standards in information security and Digital Forensic settings. 5. Understand the complex nature of digital evidence and the challenges in analysing and presenting examination findings. 6. Identify and apply the correct style and format of writing in expert reports and statements. 7. Work individually with competence to solve Digital Forensic problems. The unit provides more advanced theoretical and practical knowledge of evidence acquisition, analysis and presentation of digital information stored on computing devices and provides students with: Use of sophisticated digital forensic tools (ILookIX and IXImager) to recover digital evidence through a basic forensic examination of simulated crime and the compilation of an expert evidence report, based on the forensic examination, to demonstrate their interpretation of and justification for their findings. A greater understanding of the complex nature of digital evidence vis-à-vis its admissibility and evidentiary weight in criminal cases. The ability to recognise exculpatory evidence that may have a bearing on the outcome of future legal cases. Strategies to test and check the validity of digital evidence and forensic images for case preparations.

7 Assessment Assessable components comprise a continuous assessment protocol comprising three written quizzes on the main topics covered (10%) and the preparation of an expert report on their forensic examination of a simulated digital crime scenes (70%). (Forensic tools used ILookIX and IXImager)

8 FNSC5517 Forensic analysis of crime in the digital environment (Prerequisiteconcurrent enrolment with FNSC5506) Content This unit builds on the experience and knowledge gained from FNSC5506 and provides more advanced knowledge of digital evidence identification and analysis. Students gain theoretical understanding of the challenges to recovering obfuscated, digital evidence stored in a larger and more complex data set. The use of an advanced forensic tool will assist students undertake more advanced analysis of intricate evidence groups and opportunity to establish relationships between groups of significant events and computer users. Students have the opportunity to develop plausible hypotheses based on their analysis of more complex cases. Students prepare an expert report reflecting sound forensic analysis and practice. The unit looks at trends in the Digital Forensic environment and future challenges confronting practitioners. Learning outcomes Students are expected to demonstrate an understanding of the following learning outcomes, which are directly aligned with core concepts and principles in forensic information technology: 1. Describe how appropriate processes are applied in the course of digital evidence acquisition and preservation. 2. Understand the complex nature of digital evidence and the challenges in analysing and presenting examination findings in a criminal and civil setting. 3. Explain the application of advanced technical knowledge and appropriate procedures to computer forensic tasks. 4. Understand how to assemble and construct scientific material in the appropriate format. 5. Identify and apply the correct style and format of writing in expert reports and statements. 6. Work individually with competence to solve Digital Forensic problems of a forensic nature. 7. Awareness of trends in a field of endeavour that affect the efficacy of Digital Forensic practice, including the growing importance of Digital Forensics in Forensic Intelligence analysis. 8. Apply critical thinking skills in Digital Forensic examination. This unit builds on and provides more advanced knowledge of digital evidence identification, location and analysis, providing students with: Knowledge of trends in the Digital Forensic environment and future challenges confronting practitioners. Enhanced understanding of the challenges to recovering obfuscated, digital evidence stored in a larger and more complex data set including: o Volume Shadow Snapshot analysis. o Advanced data recovery tools (XFR Extreme File Recovery) and registry analysis.

9 The opportunity to use ILookIX analysis tools to undertake more advanced analysis of intricate evidence groups and the opportunity to establish relationships between groups of significant events and computer users, using link and analysis tools, notably:. o Lead Analysis. o Linkage. o FileSystem Event Analysis. o Cloud Analysis. o Histogram and stream profiling. Familiarity with the ediscovery automation ISeek to locate evidence in a civil setting, from large datasets and prepare an analysis report. Basic knowledge of mobile phone forensics. The opportunity to develop plausible hypotheses based on analysis of a more complex case and prepare an expert report reflecting sound forensic analysis and practice. Assessment Assessable components comprise a continuous assessment protocol which comprises two written quizzes on the main topics covered (10% each) and the preparation of an expert report on their forensic examination of two simulated digital crime scenes (40% each). (Forensic tools used ILookIX, ISeek and IVault) Course accreditation A certificate of Perlusto proficiency will be awarded for an overall Distinction grade on completion of FNS5617, FNSC5506 and FNSC5517. A light version of ILookIX will be provided without payment for each student who achieves proficiency in use of ILookIX and IXImager. Those students will also be entitled to obtain the full version of the tools at a discounted educational rate. Group discount for the purchase of ILookIX are available to those organisations where students work, subject to approval by Perlustro. Perlustro provides multifunction computer forensic examination systems which is the most widely distributed forensic tools to law enforcement, military, and intelligence agencies worldwide.