CIS 4203 IT Forensics & Investigations Summer C

Transcription

1 CIS 4203 IT Forensics & Investigations Summer C Course Abstract: This course offers an introduction to system forensics investigation and response. Areas of study include procedures for investigating computer and cybercrime, and concepts for collecting, analyzing, recovering, and preserving forensic evidence. Major Instructional Areas 1. Digital forensic investigations 2. Forensic environments and tools 3. Evidence collection and handling 4. Forensic reporting 5. Solving business challenges with forensic investigations Course Objectives 1. Summarize the basic principles of computer forensics. 2. Summarize important laws regarding computer forensics. 3. Describe various computer crimes and how they are investigated. 4. Describe digital forensic methodology and labs. 5. Outline the proper approach to collecting, seizing, and protecting evidence. 6. Explain techniques for hiding and scrambling information as well as how data is recovered. 7. Summarize various types of digital forensics. 8. Explain how to perform a network analysis. 9. Describe incident and intrusion response. Class Format: Undergraduate course is delivered asynchronously via Canvas. This class will be taught completely online. There will be a number of hands-on exercises.

2 Professor: Contact Info/Office Hours: Shane Hartman me anytime at: Required reading: System Forensics, Investigation, and Response By: Chuck Easttom 2nd edition Book version Manual + Virtual Access ISBN: Other Resources Books, Professional Journals Use the following author s names, book/article titles, Web sites, and/or keywords to search for supplementary information to augment your learning in this subject. Altheide, Cory and Harlan Carvey. Digital Forensics with Open Source Tools, Syngress, Anson, Steven, et al. Mastering Windows Network Forensics and Investigation, Sybex, Chappell, Laura. Wireshark 101: Essential Skills for Network Analysis Paperback, Laura Chappell University, Clark, Richard A., et aland Robert Knake. CYBER WAR: The Next Threat to National Security and What to Do About It, Ecco, Davidoff, Sherri and Jonathan Ham. Network Forensics: Tracking Hackers through Cyberspace, Prentice Hall, Kruse, Warren G., et al. Computer forensics; incident response essentials, December 2001, vol. 25, Issue issue 4. McCarthy, N.K., Matthew Todd, and Jeff Klaben. The Computer Incident Response Planning Handbook: Executable Plans for Protecting Information at Risk, McGraw-Hill Osborne Media, Vacca, John R. Computer and Information Security Handbook, Morgan Kaufmann, 2009.

3 Professional Associations American Academy of Forensic Sciences This organization provides an understanding of advanced science and its application to the legal system. Association of Digital Forensics, Security and Law (ADFSL) This organization focuses on the academics and research of digital forensics, security, and law. High Tech Crime Consortium This organization assists law enforcement and corporate investigators in obtaining the knowledge and skills needed to combat digital technology crime. High Tech Crime Investigation Association (HTCIA) This organization facilitates voluntary exchange of data, information, experience, ideas, and knowledge about methods, processes, and techniques relating to investigations and security in advanced technologies. Other References Berghel, Hal. Hiding data, forensics, and anti-forensics, 2007, Computer Crime & Intellectual Property Section: United States Department of Justice Computer Forensics, Cybercrime and Steganography Resources Digital Evidence Digital Evidence in the Courtroom: A Guide for Law Enforcement and Prosecutors DoD Cyber Crime Center (DC3)

4 Federal Rules of Evidence FBI oratory: Computer Analysis and Response Team Forensic Focus National Center for Forensic Science National Institute of Justice: Forensic Examination of Digital Evidence: A Guide for Law Enforcement SANS U.S. Immigration and Customs Enforcement Cyber Crimes Center (ICE)

5 Information Search Use the following keywords to search for additional online resources that may be used for supporting your work on the course assignments: Anti-forensics Attacks Chain of Custody Computer Forensics Cryptography Cybercrime Digital Forensics Forensics Evidence Expert Testimony Forensic Investigation Forensics Incident Recovery Incident Response Laws Linux Forensics Macintosh Forensics Malware Mobile Forensics Network Analysis Privacy Laws Steganography System Forensics Windows Forensics

6 Class Participation: Here is my official stance on the subject, as I have indicated to Student Advising: This course is to be taken asynchronously. Part of the student s grade is based on class participation, evaluations, and ability to do the work. Forensics is a hands-on discipline. While there is a fair amount of information to be covered most people learn this subject matter by being involved and engaged in activities. Use the following advice to receive maximum learning benefits from your participation in this course: DO DON T Do take a proactive learning approach Do share your thoughts on critical issues and potential problem solutions Do plan your course work in advance Do explore a variety of learning resources in addition to the textbook Do offer relevant examples from your experience Do make an effort to understand different points of view Do connect concepts explored in this course to real-life professional situations and your own experiences Don t assume there is only one correct answer to a question Don t be afraid to share your perspective on the issues analyzed in the course Don t be negative towards points of view that are different from yours Don t underestimate the impact of collaboration on your learning Don t limit your course experience to reading the textbook Don t postpone your work on the course deliverables work on small assignment components every day Evaluation Criteria The graded assignments will be evaluated using the following weighted categories: Category Weight Discussion 6% 30% 20% Project 24% Exam 20% TOTAL 100%

7 Grade Conversion The final grades will be calculated from the percentages earned in the course, as follows: Grade Percentage Credit A % 4.0 B % 3.5 B 80 84% 3.0 C % 2.5 C 70 74% 2.0 D % 1.5 D 60 64% 1.0 F <60% 0.0 Please note these very important class rules: 1. Academic honesty is mandatory. Cheating on tests (which means giving help or receiving help from another student, or providing unattributed/plagiarized answers) is grounds for expulsion from the class and receiving a double F, which will brand your academic career in infamy forever. If you turn in work that references someone else s work and do not properly attribute it, this is plagiarism. It is also grounds for receiving a double F in the course. This includes downloading source code from the Internet. For example, if you borrow some script code to use in your project, and it is copyrighted, you may not remove the header information and insert your own as if it were original code. This is unethical and grounds for dismissal from the class. Please be sure to review the university s policy in the USFSM Undergraduate Catalog and the USF Student Code of Conduct. 2. s are due by the beginning of class on the due date assigned. I will not accept any late assignments unless you have specifically made arrangements with me beforehand. For example, ing me at the end of the semester to request turning in all of your missed homework because you had some illness will not work. 3. Religious Observances: The University recognizes the right of students and faculty to observe major religious holidays. Students who anticipate the necessity of being absent from class for a major religious observance must provide notice of the date(s) to the instructor, in writing, by the second week of classes. 4. Disabilities Accommodation: Students are responsible for registering with the Office of Students with Disabilities Services (SDS) in order to receive academic accommodations. Reasonable notice must be given to the SDS office (typically 5 working days) for accommodations to be arranged. It is the responsibility of the student to provide the instructor with a copy of the official Memo of Accommodation. Contact Information: Pat Lakey, Coordinator, , plakey@sar.usf.edu, 5. Academic Disruption: The University does not tolerate behavior that disrupts the learning process. The policy for addressing academic disruption is included with Academic Dishonesty in the catalog: USFSM Undergraduate Catalog Occurrences of academic disruption will be addressed be the professor (depending on the situation, the student may be asked to leave or security may be called). Following the incident, the professor will establish with the student terms for

8 continued course participation, and the professor will also submit a report to the dean. The consequences to the student can range from an administrative reprimand to suspension from USF. Most students are highly motivated to learn and do not need to be informed of these things, but the 5% or so that want to get a free grade without doing any work need to be made aware of these rules. If you do not think you can abide by these (in my opinion, completely reasonable) rules, please do not take this course! Blackboard (MyUSF): All of our tests and assignments will be submitted via Blackboard. Students needing instruction in using Blackboard can use the following resources: Tutorial: USF Sarasota-Manatee Distance Education Dale Drees: ddrees@sar.usf.edu Stephanie Fuhr sfuhr@sar.usf.edu USF Tampa Academic Computing Toll-free Helpline: Live online help: Contingency Plans In the event of an emergency, it may be necessary for USFSM to suspend normal operations. During this time, USFSM may opt to continue delivery of instruction through methods that include but are not limited to: Blackboard, Elluminate, Skype, and messaging and/or an alternate schedule. It s the responsibility of the student to monitor Blackboard site for each class for course specific communication, and the main USFSM and College websites, s, and MoBull messages for important general information. The USF hotline at 1 (800) is updated with pre-recorded information during an emergency. Important dates: May 12 th Summer C, first day of classes May 26 th Memorial Day July 4 th Independence Day July 18 th Last Day of Classes

9 Course Schedule (tentative, subject to change): Grading Category Activity Title Week 1: Introduction to Forensics and Computer Crimes Required Readings Chapter 1, Introduction to Forensics Chapter 2, Overview of Computer Crime Discussion Overview of Evidence and Digital Forensic Analysis Techniques Apply the Daubert Standard on the Workstation Domain Week 2: Forensic Methods, s, and Future Trends Required Readings Chapter 3, Forensic Methods and s Chapter 14, Trends and Future Directions Chapter 15, System Forensics Resources Discussion Certifications Report Cybercrimes Digital Forensic Firms Denial of Service Tools Perform a Byte-Level Computer Audit Week 3: Collecting, Seizing, and Protecting Evidence Required Readings Chapter 4, Collecting, Seizing, and Protecting Evidence Digital Forensic Software or Equipment Proposal The Cloud or Digital Forensic Conferences Create a Forensic System Case File for Analyzing Forensic Evidence

10 Grading Category Activity Title Week 4: Understanding Techniques for Hiding and Scrambling Information, and Recovering Data Required Readings Chapter 5, Understanding Techniques for Hiding and Scrambling Information Chapter 6, Recovering Data Discussion Steganography and Its Implications for Security Proper Methods for Recovering Data Chain of Custody Roles and Requirements Best Practices in Collecting Digital Evidence Uncover New Digital Evidence Using Bootable Utilities Automate Image Evaluations and Identify Suspicious or Modified Files Week 5: Windows Forensics Required Readings Chapter 8, Windows Forensics Steganography Detection Tools or Data Recovery Plan Craft an Evidentiary Report for a Digital Forensic Case Week 6: Linux Forensics Required Readings Chapter 9, Linux Forensics Discussion Comparing Windows and Linux Forensics Investigations Project Tools for Monitoring Changes to Files and Memory Windows Forensics Apply Steganography to Uncover Modifications to an Image File Project Part 1: Preparation (draft)

11 Grading Category Week 7: Macintosh, , and Mobile Forensics Activity Title Required Readings Chapter 7, Forensics Chapter 10, Macintosh Forensics Chapter 11, Mobile Forensics Discussion Comparing Windows and Macintosh Forensics Investigations or and the Law or The Issue of Monitoring Linux Forensics Automate Digital Evidence Discovery Using Paraben s P2 Commander Week 8: Performing Network Analysis Required Readings Chapter 12, Performing Network Analysis Macintosh Forensics or Presentation or Mobile Forensics Data Doctor Appropriate Traffic Analysis Tools Decode an FTP Protocol Session and Perform Forensic Analysis Week 9: Incident and Intrusion Response Required Readings Chapter 13, Incident and Intrusion Response Discussion Adding Forensics to Incident Response Project Project Network Traffic Analysis Tool Evaluation Perform an Incident Response Investigation for a Suspicious Logon Project Part 2: Review Packet Capture (draft) Project Part 3: Examine Forensic Image (draft) Week 10: Review, Final Examination, and Project Submissions Project Network Security Breaches Investigate Evidence and Create a Report of the Findings

12 Grading Category Exam Final Examination Activity Title