COS/PSA 412 Computer Forensics and Investigations

Transcription

1 COS/PSA 412 Computer Forensics and Investigations Date: November 18, 2003 Division: Natural and Behavioral Sciences Number of Credits: 4 Location: Nadeau 109 Meeting Times: TBD Course Description Computer Forensics and Investigation presents methods to properly conduct a computer forensics investigation beginning with a discussion of ethics, while mapping to the objectives of the International Association of Computer Investigative Specialists (IACIS) certification. Instructor Instructor Tony Gauvin [email protected] Phone (207) Office Hours Office 216 Nadeau Hall 2:00 2:50 PM MR 12:30-1:30 PM W Or by appointment Text Guide to Computer Forensics and Investigations Author: Bill Nelson, Amelia Phillips, Frank Enfinger, and Chris Steuart Publisher: Thomson Course Technology ISBN #: Instructor Handouts

2 Required Materials Two 100MB Zip Disc (available at Campus Book Store) Goals and Objectives The main goal of this course is to provide you with a comprehensive understanding of computer forensics and investigation tools and techniques. You will learn what computer forensics and investigation is as a profession and gain an understanding of the overall investigative process. All major personal computer operating system architectures and disk structures will be discussed. You will learn how to set up an investigator s office and laboratory, as well as what computer forensic hardware and software tools are available. You will also learn the importance of digital evidence controls and how to process crime and incident scenes. Finally, you will learn the details of data acquisition, computer forensic analysis, investigations, image file recovery, investigative report writing, and expert witness requirements. The course provides a range of laboratory and hands-on assignments that teach you about theory as well as the practical application of computer forensic investigation. Requirements Students will be required to demonstrate their knowledge of Computer Forensics through examinations, assigned projects, exercises and the Capstone project. An individualized Capstone project will allow each student to develop an in-depth understanding of a particular aspect of networking and will allow the students to demonstrate his/her ability to apply newly learned skills and concepts to the instructor and his/her classmates. Other Resources WebCT Text Book Website International Association of Computer Investigative Specialists Computer Crime and Intellectual Property Section (CCIPS) of the Criminal Division of the U.S. Department of Justice Maine Computer Crimes Task Force Instructor Web Site

3 Method of Instruction Lectures and demonstrations covering the above listed material will be further supplemented with hands-on Computer Forensics lessons. Lectures will provide general conceptual overviews and demonstrations of the related technologies and procedures. Labs and project assignments will be (to the greatest extent possible) tailored to the participants'needs. Materials from outside sources will be used for added emphasis. All information and material presented in class and through assigned readings are to be considered fair game in any exam. Method of evaluation The examinations will be comprised of questions that test the student s knowledge of the concepts along with their ability to apply those concepts to real-world Computer Forensics issues. The Capstone project will be evaluated on content, form, presentation and the ability of the student to conduct independent in-depth research on topics of value with the Computer Forensics area. Weekly assignments will be required to demonstrate understanding of the concepts being discussed. Students will be expected to participate and collaborate with their classmates and the course instructor. Attendance at all classes without participation does not warrant a full 10% in the over-all course grade. Course Grade Calculation Exams 6% each) 24% Assignments 24% Labs 4% each) 24% Capstone Project 18% Attendance/Participation 10% 100% Grading Scale A % B % C % D % F 0-59 % At his/her discretion, the instructor may add a plus to a student s grade score to indicate superior achievement within the scope of the assigned grade. No minus grades will be given.

4 Course Schedule Class Date Subject Required Reading Sept 4 Sept 8 & 11 Sept 15 & 18 Sept 22 & 25 Sept 29 & Oct 2 Oct 6 & 10 Oct 13 Oct 15 Oct 20 & 23 Syllabus Computer Forensics and Investigations as a Profession Understanding Computer Investigations Working with Windows and DOS Systems Working with Windows and DOS Systems (cont.) Macintosh and Linux Boot Processes and Disk Structures The Investigator s Office and Laboratory Current Computer Forensics Tools Fall Break Current Computer Forensics Tools (cont.) Digital Evidence Controls Processing Crime and Incident Scenes Chapters 1 and 2 Notes Chapter 3 Lab 1 Chapter 4 Chapter 5 Chapter 6 Lab 2 Exam 1 Chapters 7 and 8 Lab 3 Oct 27 & 30 Data Acquisition Chapter 9 Lab 4 Nov 3 & 6 Computer Forensic Chapter 10 Exam 3 Nov 10 & 13 Analysis Computer Forensic Analysis (cont.) Lab 5 Nov 17 & 20 Investigations Chapter 11 Nov 24 Recovering Image Files Chapter 12 Lab 6 Nov 27 Dec 1 & 4 Dec 8 & 11 Thanksgiving Break Writing Investigation Reports Becoming an Expert Witness Review Chapter 13 Exam 4 Finals

5 Absence Policy As participation is considered essential to a successful educational experience, students may register at most two unexcused class absences before being considered dropped from the course. Excused absences are those for which prior arrangements have been made with the instructor or extenuating circumstances can be clearly documented. Please check with the instructor and make arrangements prior to any planned absences. There will be no makeup exams, students must instead make arrangements with the instructor to take the exam prior to the planned absence or forfeit the opportunity to complete it. Students failing to maintain a passing grade at any point during the semester may be involuntary dropped from the course through an instructor-initiated withdrawal process. Overall, it is essential to keep the instructor informed of your progress as well as any difficulties you may be experiencing. Special Notes Any student who qualifies for accommodations based on the impact of a disability should contact Academic & Counseling Services during the first two weeks of class at Room 107 Cyr Hall. Academic & Counseling Services will coordinate reasonable accommodations for students with documented disabilities A student s work should be their own. Collaboration between students is encouraged, but the work products delivered for grading should reflect the individual student s efforts. Students who produce identical work products will share in the grade generated. The creation of student study groups is strongly encouraged Students who plagiarize published works will receive a score of zero on the plagiarized work upon the first offense. A subsequent offense will warrant failure of the entire course. WebCT will be used to keep students appraised of their progress and as a communication forum for instructor/student and student/student interactions. Its use is mandatory for all students. Students must record on all submitted materials their name, instructor name(s), course and assignment number, and date of submission. Students are encouraged to retain for their record a personal copy of all submitted materials. Students are encouraged to regularly submit during non-class hours constructive suggestions regarding delivery of the course.

6 The instructor(s) reserve(s) the right to make necessary changes to the syllabus in light of any circumstances occurring during the delivery of the course provided such changes are announced in class. Students are required to observe appropriate error prevention techniques throughout the semester. For example, students must frequently save their work to disk to prevent loss. Loss due to power fluctuations, illegal instructions, viruses, or any other reason beyond the instructors'control will not constitute adequate reason for accommodations. Assignments are due no later than the beginning of the class on the date assigned. Assignments submitted beyond the due date will receive a twenty-point reduction per day. Assignments submitted on the correct day but beyond the required time will receive a ten-point deduction. The course teaches skills and procedures that are intended to be used by law enforcement and security personnel. These same skills and procedures if misapplied or used in improper situations may subject the practitioner to criminal and/or civil penalties. Laws governing these behaviors vary from locality to locality and it is the practitioner s responsibility to be cognizant of local laws pertaining to Computer Forensics and investigative techniques. It is expected that the students in this course use there new found knowledge in legitimate pursuits.