DIGITAL FORENSICS SPECIALIZATION IN BACHELOR OF SCIENCE IN COMPUTING SCIENCE PROGRAM

Transcription

1 DIGITAL FORENSICS SPECIALIZATION IN BACHELOR OF SCIENCE IN COMPUTING SCIENCE PROGRAM Proposed Program Title: Bachelor of Science in Computing Science- Specialization in Digital Forensics Specialization Proposed Credential Nomenclature: B.Sc. (Honours) in Computing Science Disciplines/Fields of Study: Digital Forensics Is a work experience/work placement term required for degree completion? An optional workplace experience has been proposed for all science programs and once approved will be made available in Anticipated Program Start Date: First-year entry in September 2007 Program Learning Outcomes and Curriculum Design All the attributes of the original Computing Science program are retained, including program learning outcomes, course content and sequencing and the maintenance of appropriate degree level standards. Additional program learning outcome specific to this stream: acquire specialized knowledge and understanding of the concepts, theories, principles and applications of digital systems, and forensic informatics, and their relation to the use of computers in forensic investigations Resource Requirements UOIT has specialized labs and equipment in existing Computing Science and Forensic Science facilities. A modest amount of specialized equipment as described in course outlines will be needed for the new course. A small enhancement of library holdings will be needed as well. The proposed specialization is expected to be a very cost-effective addition to the UOIT science offerings in computing and forensics. Projected Enrolment and Faculty Growth Projected steady-state enrolment is 15 students per year entering the program. Since there are only two new courses required for the program, the additional faculty resource requirements are minimal. Bachelor of Science in Computing Science- Specialization in Digital Forensics 1

2 Bachelor of Science (Honours) in Computing Science- Specialization in Digital Forensics Description of Proposed Specialization The Faculty of Science currently offers undergraduate degrees in both Computing Science and Forensic Science. The Computing Science Specialization in Digital Forensics will build on both of these programs to produce a new specialization within the Computing Science program that focuses on digital forensics. This will be basically a Computing Science degree with its electives drawn from the Forensic Science program and with two additional courses in Computing Science. Except for the two new Computing Science courses, all the other courses in this program are currently being offered in either the Computing Science or Forensic Science program. As computers become more prevalent in our society there is an increasing need for forensic experts to consider computers and related digital technology as important pieces of evidence. Due to the complexity of these technologies specialized skills are required to analyze them in order to detect criminal activity and gather evidence. There is a growing awareness for the need for educational programs to train specialists in this area, and this is the main reason for introducing this specialization within our Computing Science program. Internationally, there are very few undergraduate programs that address digital forensics. Most of the existing programs are either graduate programs or certificate programs, and even these programs are relatively rare. By being one of the first universities to offer a Digital Forensics specialization we hope to establish UOIT as a leader in this field. The Program The specialization has a strong foundation in the basic Computing Science program. The major difference is that CSCI 3040U Systems Analysis and Design in Applications and CSCI 3060U Software Engineering are replaced by CSCI 4120U Digital Evidence and CSCI 4130U Forensic Informatics. It was necessary to delete the two Computing Science courses in order to make room for the Forensics courses and still meet the Liberal Studies requirements. In addition, this proposed new specialization includes the following Forensics courses: FSCI 1010U Introduction to Forensic Science, FSCI 2010U Crime Scene Science, FSCI 3010U Criminalistics, FSCI 4050U Law for Forensic Scientists and FSCI 4060U Advanced Topics in Forensic Science. Course descriptions for these courses which have already been assessed in the approved BSc in Forensic Science are provided on the next page Bachelor of Science in Computing Science- Specialization in Digital Forensics 2

3 FSCI 1010U Introductory Forensic Science This course introduces Forensic Science to students with no prior knowledge of the subject. Having completed the course, the student will be aware of the multidisciplinary nature of forensic science, how a case is studied, the use of scientific techniques in case investigations and the presentation of evidence in court. The student will be encouraged to develop a critical approach to assessing evidence. Lect: 3hrs. Tutorial: 2hrs Bi-Weekly FSCI 2010U Crime Scene Science This course introduces students to all the processes that occur at a crime scene. Students will be taught crime scene procedures, from the photography of the scene and record keeping at the scene through to the preservation and collection of evidence from crime scenes. This will include techniques for the recovery of fingerprints, footwear marks, and tool marks and the collection and correct packaging of items such as hairs, fibers, glass and paint. Students will also be introduced to the legal and documentary framework that accompanies the collection and preservation of evidence. In addition to theoretical knowledge, students will experience the practicalities of searching for and recovering evidence from crime scenes. The evidence will be examined and considered in terms of the amount of information that can be obtained from the analysis. The module will stress the multidisciplinary nature of forensic investigations and integrate legal, practical and scientific aspects of crime scene investigations. Lect: 3hrs, Lab: 3hrs Bi-Weekly, Other: 3hrs Bi-Weekly. Pre-requisites: FSCI 1010U Introductory Forensic Science, and clear standing in one of the Forensic Science, Forensic Physics or Digital Forensics programs. FSCI 3010U Criminalistics Building on the material introduced in Crime Scene Science, this course provides experience of major crime scene investigation, such as aggravated burglaries and sexual or violent offences. Importantly it also provides the principles of the laboratory based searching and recovery of evidence and the techniques and principles involved in the analysis of forensic evidence, such as hair, glass, toolmarks, footwear and tire marks, handwriting and document analysis, firearms examination and ballistics, fingerprints. Lect: 3hrs, Lab: 3 hrs Bi-Weekly, Other: 2hrs Bi-Weekly. Prerequisite: Successful completion of year 3, semester 1 in one of the Forensic Science, Forensic Physics or Digital Forensics programs. FSCI 4050U Law for Forensic Scientists This course explores aspects of criminal law, with the goal of understanding forensic science within a legal context. Topics include: structure of the courts system and the criminal procedures used in it, roles of the forensic scientist in criminal procedures, rules of evidence, role of expert witness. Lecture: 3hrs, Other: 2hrs Bi-weekly. Prerequisite: Good standing in year 4 of one of the Forensic Science, Forensic Physics or Digital Forensics programs. FSCI 4060U Advanced Topics in Forensic Science The course builds on techniques covered previously throughout the program and provides an opportunity for students to compare and critically evaluate the use, strengths and limitations of such techniques in forensic cases. In addition, students will be provided with the opportunity to study a range of high technology and emerging forensic science advances, such as electronic, computerized and Bayesian statistical methods for the analysis, interpretation and critical evaluation of forensic evidence. Tutorials: 3hrs. Prerequisite: Good standing in year 4 of one of the Forensic Science, Forensic Physics or Digital Forensics programs. The course map for this new specialization and the course outlines for the two new Computing Science course are provided on the pages which follow. Bachelor of Science in Computing Science- Specialization in Digital Forensics 3

4 Year- Sem. Subject Subject Subject Subject Subject 1-1 Calculus I MATH 1010U Physics I PHY 1010U Chemistry I CHEM 1010U Linear Algebra MATH 2050U Scientific Computing Tools CSCI 1000U 1-2 Calculus II MATH 1020U Introduction to Forensic Science FSCI 1010U Chemistry II PHY 1020U Fundamentals of Programming CSCI 1020U Biology for Engineers BIOL 1840U 2-1 Discrete Structures in Computer Science CSCI 2010U Principles of Computer Science CSCI 2010U Computer Architecture I CSCI 2050U Statistics and Probability for Physical Science STAT 2010U Crime Scene Science FSCI 2010U 2-2 Computational Science I MATH 2072U Software Systems Development and Integration CSCI 2020U Physics II PHY 1020U 3-1 Analysis and Design of Algorithms CSCI 3070U Operating Systems CSCI 3020U Database Systems and Concepts CSCI 3030U Computer Networks CSCI 3150U Criminalistics FSCI 3010U 3-2 Computer Architecture II CSCI 3050U Scientific Visualization and Computer Graphics CSCI 3090U Compilers CSCI 4020U 4-1 Simulation and Modelling CSCI 3010U Digital Evidence CSCI 4120U Forensic Informatics CSCI 4130U Analysis and Design of Algorithms CSCI 3070U 4-2 Thesis Project CSCI 4400U Ethics, Law and the Social Impact of Computing CSCI 4040U Law for Forensic Scientists FSCI 4050U Advanced Topics in Forensic Science FSCI 4060U Shading = New course in Digital Forensics specialization. Bold= Existing course in Forensic Science Program s and Breadth Requirements: Students are required to take 18 credit hours in electives. In order to satisfy breadth requirements, all of these must be in courses outside computing science (CSCI); at least 12 credit hours must be in courses outside the Faculty of Science, and should include BUSI 2000U Collaborative Leadership. Bachelor of Science in Computing Science- Specialization in Digital Forensics 4

5 COURSE OUTLINES FOR NEW COURSES IN DIGITAL FORENSICS COURSE TITLE: CSCI 4120U Digital Evidence Pre-requisites: CSCI 3020U Operating Systems CSCI 3150U Computer Networks Year and Semester: Year 4, Semester 1 Course Description and Content Outline: This is an introductory course in digital forensics, the gathering of evidence from computers that have been involved in a crime. This course covers the use of computers in the commission of crimes, basic evidence gathering techniques, examination of main memory and file systems, network analysis and mobile devices. Syllabus: Crimes involving computers, case studies and basic technical issues Evidence collection techniques, the importance of time and collecting volatile information. Basic file system analysis for Unix and Windows-based systems, and the recovery of lost, hidden or misplaced information. Examining operating system files and logs, detecting attacks and various security risks. Tools for the analysis of file systems and collecting evidence of a crime Basic network hardware and software Analysis of physical network structures, threat detection and avoidance Analysis of network traffic, collection of information, intrusion tracing Wireless networks Evidence collection from cell phones and other embedded system devices. Methods of Delivery: 3 hours of lecture per week, 3 hours of laboratory bi-weekly Student Evaluation (typical): Two or three graded assignments, graded lab problem sets, a midterm examination and a final examination. The exact weighting of the components will be determined by the professor assigned to teach the course and presented to the students in the first week of classes. Resources to be purchased/provided by students: textbooks Bachelor of Science in Computing Science- Specialization in Digital Forensics 5

6 COURSE TITLE: CSCI 4120U Digital Evidence cont d Suggested Textbook Requirements: The following is a list of representative textbooks appropriate for this course. This list is not exhaustive and the course instructor is encouraged to select texts appropriate for the focus he/she wants to place on the course. Dan Farmer and Wietse Venema, Forensic Discovery, Addison-Wesley, 2005 Eoghan Casey, Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet, 2 nd Edition, Elsevier Academic Press, Brian Carrier, File System Forensic Analysis, Addison Wesley, 2005 Learning Outcomes: Students who successfully complete this course have reliably demonstrated the ability to: Outcome 1. Outcome 2. Outcome 3. Outcome 4. Outcome 5. Outcome 6. Examine a computer for evidence of criminal activity and preserve as much evidence as possible. Follow standard procedures for evidence collection that will stand in a court of law. Use standard tools for computer system and network analysis. Understand the problems and issues involved with analyzing network data. Know the standard techniques used by criminals to hide information and mislead forensic analysis. Understand the special challenges involved with the analysis of embedded systems. Rationale: Computer crimes are becoming increasingly sophisticated and gathering evidence from these crimes requires a matching level of sophistication on the part of the investigator. This course covers the basic techniques used in the forensic analysis of computer systems and draws heavily on the material presented in previous computer science and forensics courses. The lectures will be used to present the basic concepts and demonstrate the basic techniques. The laboratories and assignments give the students an opportunity to develop investigative skills and practical knowledge. Information about course designer/developer: Dr. Mark Green and Dr. William Smith, UOIT Faculty of Science; Dr. Zeno Geradts, Netherlands Forensic Institute List of faculty eligible to teach the course: Dr. Mark Green and faculty to be hired. Occasional guest lectures will be delivered by forensic science experts working in the field. Are there any plans to teach all or portions of this course on-line? A course website will contain all the lecture material for the course along with assignments, laboratory information and other resources useful to the students. Bachelor of Science in Computing Science- Specialization in Digital Forensics 6

7 COURSE TITLE: CSCI 4120U Digital Evidence cont d Faculty qualifications to teach/supervise the course: A Postgraduate degree (Ph.D. preferred) in computer science with a specialization in the systems area. Experience with developing or analyzing computer systems will be desirable. Classroom requirements: A technology-enhanced classroom with laptop connections, data projector, and internet access should be available. Equipment Requirements: A laboratory where several computers are available for forensic analysis, as well as a small network that is not connected to the main campus network; electronic and related equipment for examining and analyzing embedded system devices Bachelor of Science in Computing Science- Specialization in Digital Forensics 7

8 COURSE TITLE: CSCI 4130U Forensic Informatics Pre-requisites: CSCI 3030U Database Systems and Concepts Year and Semester: Year 4, Semester 1 Course Description and Content Outline: This course examines the use of digital information in the examination and analysis of crime scene information and evidence. It covers image and sound analysis and enhancement, pattern recognition techniques, databases, and computer models of criminal activities. Introduction to basic image and signal processing techniques Image, video, and audio analysis and enhancement Biometrics (fingerprint, face, iris, and related identification systems) Database and data-mining techniques for evidence analysis and processing Computer modeling of criminal activities Methods of Delivery: 3 hours of lecture per week, 3 hours of laboratory bi-weekly. Student Evaluation (typical): Two or three graded assignments, graded lab problem sets, midterm examination and final examination. The exact weighting of the various components will be determined by the professor assigned to teach the course and presented to the students in the first week of classes. Learning Outcomes. The students who successfully complete this course have reliably demonstrated the ability to: Outcome 1. Outcome 2. Outcome 3. Outcome 4. Outcome 5. Understand the analysis and enhancement of image, video, and audio evidence. Understand how to store various forms of evidence in a digital form that preserves the information and will be acceptable in a court of law. Understand biometric identification systems Be able to design and search databases containing information on crimes and evidence. Understand how computer models and simulations can assist with criminal investigations and how to develop these models. Rationale: Digital techniques can be used to store, process and enhance various types of evidence. This course provides the student with an introduction to the techniques that are used in this area with an emphasis on the basic principles and their applicability to various types of evidence. The lectures will identify potential uses of computer technology in the processing of evidence and sources for further information on each topic. The labs and assignments will expose the student to the practical issues of processing evidence and developing models of criminal activity. Bachelor of Science in Computing Science- Specialization in Digital Forensics 8

9 COURSE TITLE: CSCI 4130U Forensic Informatics cont d Information about Course Designer/Developer: Dr. Mark Green and Dr. William Smith, UOIT Faculty of Science; Dr. Zeno Geradts, Netherlands Forensic Institute List of faculty eligible to teach the course: Dr. Mark Green and faculty to be hired. Occasional guest lectures will be delivered by forensic science experts working in the field. Are there plans to teach all or portions of this course on-line? A course website will contain all the lecture material for the course along with assignments, laboratory information and other resources useful to the students. Faculty qualifications to teach/supervise the course: A Postgraduate degree (Ph.D. preferred) in computer science with a specialization in the systems area. Experience with developing or analyzing computer systems will be desirable. Classroom requirements: A technology-enhanced classroom with laptop connections, data projector, and internet access should be available. Equipment requirements: A laboratory containing equipment for image, video, and audio processing, manipulating databases of images, data-mining, and biometrics devices Bachelor of Science in Computing Science- Specialization in Digital Forensics 9

10 Enrolment Projections and Staffing Implications Projected Enrolment and Faculty Growth Projected steady-state enrolment is 15 students per year and if resources permit, this number may be increased. The projected faculty growth supporting the program is given in the following table: Year Students enrolled New Science Faculty Annual intake will be 15 students; this should be reasonable to achieve because of general interest in Forensics and the absence of any competing program in Canada. - Student attrition factors are 0.8, 0.7, and 0.65 in years 2, 3, and 4, all relative to first year. Bachelor of Science in Computing Science- Specialization in Digital Forensics 10