CTC 328: Computer Forensics

Transcription

1 FALL 2010 CSUDH COMPUTER SCIENCE DEPARTMENT CTC 328: Computer Forensics Instructor: Adam Kaplan, Ph.D. Office: NSM E-117 WWW (Blackboard Site): Class Meetings: Saturday, 12:30pm - 2:45pm in SAC 2102 Lab Meetings: Saturday, 3:00pm - 4:45pm in SAC 2102 Final Exam: Saturday, December 11 th, 2010, 12:00pm-2:00pm in SAC 2102 All exams except final will be taken in class during regular meeting time. Prerequisites: CSC 116 (Introduction to Computer Hardware & Tools) or consent of instructor. Students should have a working knowledge of hardware and operating systems (OSs) to maximize their success on projects and exercises throughout the course. Text/References Guide to Computer Forensics and Investigations by Bill Nelson, Amelia Phillips, and Christopher Steuart, Course Technology, Cengage Learning, 4 th Edition, ISBN-13: Catalog Description This course presents methods to properly conduct a computer forensics investigation, beginning with a discussion of ethics while mapping to the objectives of the International Association of Computer Investigative Specialists (IACIS) certification. Course Goals & Objectives The course provides a range of laboratory and hands-on assignments that provide a balanced introduction to the theoretical and practical aspects of computer forensic investigation. Students will learn the basics of data acquisition, computer forensic analysis, investigations, image file recovery, and investigative report writing.

2 Learning Outcomes Upon completion of this course, students will be able to Define and demonstrate understanding of Computer Forensics Demonstrate understanding of enforcement agency investigations Demonstrate understanding of corporate investigations Understand what it means to maintain professional conduct Describe a search warrant Prepare a case Begin and execute an investigation Demonstrate understanding of data-recovery workstations and software Demonstrate understanding of file systems Explore Microsoft disk structures Examine New Technology File System (NTFS) disks Demonstrate understanding of Microsoft boot tasks Determine the physical layout of a Computer Forensics lab Select a basic forensic workstation Create forensic boot media Retrieve evidence data remotely using a network connection Use command-line forensics tools Explore forensics tools Explore Computer Forensics hardware Identify digital evidence Secure digital evidence at an incident scene Catalog digital evidence Store digital evidence Obtain a digital hash of a file, and use this to validate evidence Attendance The student is responsible for materials missed during an absence, whether excused or not. Classes will start at the prescribed time and will end at the prescribed time. Instructor will be available during the posted office hours and you may make an appointment for times not posted. Academic Honor Code Programming assignments must be done individually. Failure to do so will result in a violation of the CSUDH Academic Honor Code. The following cases will be considered as violations: identical code, and extremely similar code. Violations will be reported to the Office of Vice President of Academic Affairs. Attendance Policy Excessive absences will result in lowered grades. Excessive absenteeism, whether excused or unexcused, may result in a student s course grade being reduced or in assignment of a grade of F. Absences are accumulated beginning with the first day of class.

3 Student Academic Appeals Process Authority and responsibility for assigning grades to students rests with the faculty. However, in those instances where students believe that miscommunication, error, or unfairness of any kind may have adversely affected the instructor s assessment of their academic performance, the student has a right to appeal by the procedure listed in the Undergraduate Catalog and by doing so within thirty days of receiving the grade or experiencing any other problematic academic event that prompted the complaint. ADA Statement Students with disabilities, who believe they may need an academic adjustment in this class, are encouraged to contact me as soon as possible to better ensure receipt of timely adjustments. Definition Of Cheating and Plagiarism CSUDH is dedicated to a high standard of academic integrity among its faculty and students. In becoming part of the California State University academic community, students are responsible for honesty and independent effort. Disciplinary action will be taken against any student who alone or with others engages in any act of academic fraud or deceit. (Read University Regulations in University Catalog) Project Descriptions: TBA Grading Labs 40% Midterm Exam 30% Final Exam 30% Grading Scale = A = A = B = B 80-82=B =C =C 70-72=C =D =D below 60 = F

4 Tentative Course Outline Week Topic Lab Discuss syllabus 1 (8/28) Computer Forensics and investigations as a profession (Chapter 1) Understanding computer investigations (Chapter 2) 2 (9/4) Understanding computer investigations (Chapter 2, cont) The Investigator s Office & Laboratory (Chapter 3) Acquire a USB drive with ProDiscover Basic 3 (9/11) Data Acquisition (Chapter 4) Linux Live media and Linux acquisition 4 (9/18) Processing Crime & Incident Scenes (Chapter 5) 5 (9/25) Working with Windows and DOS Systems (Chapter 6) 6 (10/2) Working with Windows and DOS Systems (Chapter 6, cont) Obtaining a digital hash and conducting investigation with FTK Examining files and file-systems in Hex Workshop Hex Workshop: examining common file headers 7 (10/9) Current Computer Forensics Tools (Chapter 7) Midterm Exam review 8 (10/16) Midterm Exam 9 (10/23) Macintosh and Linux Boot Processes and File Systems (Chapter 8) Linux command-line tools and forensic software

5 10 (10/30) Computer Forensics Analysis and Validation (Chapter 9) Bit shifting in Hex Workshop / Remote acquisition with DiskExplorer and HDHOST 11 (11/6) Recovering Graphics Files (Chapter 10) Finding and fixing altered JPEG headers 12 (11/13) Virtual Machines, Network Forensics, and Live Acquisitions (Chapter 11) Reconstruct a graphics file from fragments 13 (11/20) Investigations (Chapter 12) Recovering in FTK and carving with Hex Workshop 14 (11/27) THANKSGIVING HOLIDAY (No lecture this week) 15 (12/4) Cell Phone and Mobile Device Forensics (Chapter 13) Report Writing for High-Tech Investigations (Chapter 14) 16 (12/11) Final Exam All lab work is due no later than the last week of the semester (Saturday 12/4, week 15).