CURRICULUM POST GRADUATE EDUCATION FOR NORDIC COMPUTER FORENSIC INVESTIGATORS

Transcription

1 CURRICULUM POST GRADUATE EDUCATION FOR NORDIC COMPUTER FORENSIC INVESTIGATORS Module 3B Linux artifacts Approved by the board at NPUC 16 th of September 2015

2 1. Introduction Personal computing has for years been dominated by Windows operating system and lately there has been an increase in the use of Macintosh operating systems. There are also other operating systems which are widely used but not as well known. These systems form the core services provided by the Internet. UNIX or UNIX-like systems such as Linux have been part of the Internet and corporate servers for many years and it is expected to remain so for the foreseeable future. Furthermore, embedded systems like those made for navigation, smart systems and the Internet of Things, are all most likely using Linux. As the ultimate aim of every case is the successful prosecution of the case in a courtroom, so in this course, the students will capable to utilise Linux artifacts in an investigation and thereby ensure that any evidence acquired from such systems will be admissible in a court. The NCFI programme consist of the following modules: Module 3A Forensic tool development Module 3B Linux artifacts Module 3C Open Source Forensics Module 3D Macintosh computer forensics Other module parts Module 2: Nordic Computer Forensics Investigators - 25 ECTS Module 1: Nordic Computer Forensics Investigators, introduction - 5 ECTS 2. Aim The aim of the study is to ensure a high level of quality in digital forensic investigation thereby ensuring legal protection and civil liberties are upheld. 3. Target group and admission criteria 3.1. Target group The primary target group is employees in the police service within the Nordic countries whose primary job is the handling and investigation of digital evidence. Curriculum for Nordic Computer Forensics Investigators Module 3B 2015 Page 2

3 It is presumed that the applicants have been chosen in accordance with the local plan for competency. Employees in other Nordic governmental agencies which cooperate with the police and work with digital evidence on a daily basis, are also entitled to apply Admission criteria Applicants for module 3B must: Be employed by a governmental agency Have passed NCFI 2 (Nordic Computer Forensics Investigators, module 2) or similar education Have at least one year of experience in digital forensic or cybercrime investigation With specific approval, exceptions to the requirement of post graduate education from the Norwegian Police University College may be made. It is the responsibility of the applicant to document all relevant education if they wish to avail of this facility. 4. Learning outcome 4.1. General competence After completion of the module candidates will: Show a deep understanding of the importance of artifacts in digital forensics Perceive the field of digital forensics in a broader context Identify ethical dilemmas during investigations 4.2. Knowledge After completion of the module candidates possess knowledge of: Systems running Linux operating systems Different artifacts within a Linux file system The distinction between different Linux file systems Curriculum for Nordic Computer Forensics Investigators Module 3B 2015 Page 3

4 4.3. Skills After completion of the course candidates are able to: Utilise Linux artifacts in an investigation Evaluate the relevance of Linux artifacts in relation to an investigation Conduct advanced Live Data Forensic techniques on a Linux system 5. Organisation and working demands This course will be delivered on-line through a combination of lectures, exercises, quizes and assignments. The approximate duration of the course is 280 hours of student workload. Students may choose to study at their own pace, however, it is expected that students will complete the course within 2 semesters. Student support will be delivered via electronic means such as: , discussion forums, chat, video conferences, etc. An online e-learning platform is used in the administration and implementation of the course. Working demands The following course requirements must be met and approved before students sit the exam: Completion of up to 10 on-line MCQ tests throughout the course. Students have multiple attempts at these tests if necessary. 6. Assessment The study concludes with an exam consisting of two parts: Submission of a task An oral examination based on the task Curriculum for Nordic Computer Forensics Investigators Module 3B 2015 Page 4

5 It is used a graded scale with five levels from A to E for passes and F for fail. Both parts of the exam must be passed. It is given an overall grade where oral examination may adjust the grade one step, up or down. 7. Literature 7.1. Mandatory literature Students will be examined on all material published in the lessons, and a number of specific web resources and research articles which will be provided to students during the course. These will form part of the mandatory reading requirements and will be examinable. In addition, the following books will be part of the mandatory literature. (List of books has yet to be decided) Curriculum for Nordic Computer Forensics Investigators Module 3B 2015 Page 5