CIS 296 Computer Forensics Proposed Start: Spring Instructor's Name: Office Location: Office Hours: Office Phone:

Transcription

1 CIS 296 Computer Forensics Proposed Start: Spring 2011 Instructor's Name: Office Location: Office Hours: Office Phone: Course Description: In this course students will develop the skills required to effectively use the tools and procedures utilized in computer forensics. This includes analyzing Windows computer systems and computer networks to retrieving lost, deleted, or hidden information Illinois Articulation Initiative (IAI) number Credit and Contact Hours: 4 Lecture/Demonstration Lab/Studio 4 Credit Hours Prerequisite: CIS 275 and CIS 292 or department consent. Books, Supplies, and Supplementary Materials: Textbooks/Reading list Required 1. Carvey (0 ). Windows Forensic Analysis. 2nd Edition. Snygress. Manuals/Study Guides Required - None Periodicals

2 Required - None Software Required - None Supplementary materials 1. Flash or external hard drive strongly recommended. 2. First Responders Guide to Computer Forensics? PDF file available for free download at or from instructors ICampus or FTP sites Methods of Instruction: - Lecture Other Methods - Student Learning Outcomes: Course Content Outcomes 1. Have a good understanding of the theory, requirements and laws related to computer forensic analysis and network incident response. 2. Understand the procedures required to perform computer forensic examinations. 3. Develop the skills and knowledge used to analyze Windows computers and networks for forensic evidence. 4. Understand the tools and techniques used for forensic examination of volatile and persistent information on windows systems. General Education Student learning outcomes: None Graded assignments and policies: Graded Assignments None Grading policy None Major Tests and Quizzes Four? 50 question Exams with Multiple Choice, True/False, and short answer questions. Tests will be presented online on ICampus and taken in class. Each Test = 100 points Classroom Policies and Procedures

3 A. General Information B. Attendance Policy C. Make-up Policy D. Extra-credit Policy E. Final Exam Information F. Academic Honor Code The objective of the academic honor code is to sustain a learning-centered environment in which all students are expected to demonstrate integrity, honor, and responsibility, and recognize the importance of being accountable for one's academic behavior. G. College Statement about grades of 'F' and withdrawal from class o Students may withdraw from a course by processing an add/drop form during regular office hours through the Registration and Records Office at Main Campus or Romeoville Campus, or by phone at Please note the withdrawal dates listed on your bill or student schedule. Every course has its own withdrawal date. Failure to withdraw properly may result in a failing grade of 'F' in the course. o At any time prior to the deadline dates established, an instructor may withdraw a student from class because of poor attendance, poor academic performance or inappropriate academic behavior, such as, but not limited to, cheating or plagiarism. H. Intellectual Property Students own and hold the copyright to the original work they produce in class. It is a widely accepted practice to use student work as part of the college's internal self-evaluation, assessment procedures, or other efforts to improve teaching and learning and in promoting programs and recruiting new students. If you do not wish your work to be used in this manner, please inform the instructor. I. Student Code of Conduct Each student is responsible for reading and adhering to the Student Code of Conduct as stated in the college catalog. J. Sexual Harassment Joliet Junior College seeks to foster a community environment in which all members respect and trust each other. In a community in which persons respect and trust each other, there is no place for sexual harassment. JJC has a strong policy prohibiting the sexual harassment of one member of the college community by another. See Catalog or Student Handbook. K. Student Support a. Disability Services: Student Accommodations and Resources (StAR): If you need disability-related accommodations, specialized tutoring, or assistive technology in this class, if you have

4 emergency medical information you wish to share with me, or if you need special arrangements in case the building must be evacuated, please inform me immediately. Please see me privately after class or at my office. New students should request accommodations and support by scheduling an appointment with the Student Accommodations and Resources (StAR) Office, Campus Center 1125, (815) b. Tutoring: c. Counseling and Advising: d. Academic Resources: e. Support Programs: f. Technology Support: L. Safety M. College Documentation Styles Topical Outline 1 VMWare Player Computer Ethics Introduction to Windows Forensics 2 Processing Forensic Events - Evidence, Legal Issues, Basic Tools and Considerations Windows Forensic Analysis - Preface CorporateForensicsSupport.pdf (4 pages) DOJ - Forensic Examination Of Digital Evidence.Pdf - Introduction, Chapter 1 (4 pages total) Fundamental Computer Investigation Guide for Windows - Overview, Chapter 1 (10 pages total) Compliance and Computer Forensics Computer Forensics: Admissibility of Evidence in Criminal Cases First Responders Guide to Computer Forensics - Module 1 Cert VTE Forensics Legal/Compliance 1-4 What to Bring to A Computer Forensics Investigation 3- Live Response Data Collection Windows Forensic Analysis Chapter Live Response Data Analysis Windows Forensic Analysis Chapter 2 Test #1 6 Windows Memory Analysis Windows Forensic Analysis Chapter 3 7 Hardware and File System Basics First Responders Guide to Computer Forensics Module Forensic Duplication and Persistent First Responders Guide to Computer Forensics - 9 Data Collection Module 4 Collecting Persistent Data Test #2 10 Persistent Data Ananlysi; Searching, Windows Forensic Analysis Chapter 5 Hash analysis, and Data Carving 11 Executable File Analysis and Rootkits Test #3 Windows Forensic Analysis Chapter 6 and Chapter 7

5 12 Registry Analysis Windows Forensic Analysis Chapter 4 13 Internet Analysis To be Announced 14 Hidden/Protected Evidence and AntiForensics.pdf Anti-Forensics Everyday password cracking.pdf Steganography 0707.pdf How Online Criminals Make Themselves Tough to Find.pdf 15 Final Exam/Final Projects Effective Date: 04-Jan-11 Signature of Department Chair: CID: 1554