Tuskegee University Department of Computer Science Course No: CSCI 390 (Computer Forensics) Fall MWF 1:00-2:300, BRIM 301

Transcription

1 Tuskegee University Department of Computer Science Course No: CSCI 390 (Computer Forensics) Fall MWF 1:00-2:300, BRIM 301 Instructor: Dr. C. L. Chen Office: In the office complex Phone: Office Hours: Please see the schedule posted on the instructor s door. ~~~~~~~~ Overview of the Course ~~~~~~~~ Course Description This course introduces fundamentals of computer forensics and cyber crime scene analysis including laws, regulations, and international standards. It takes a detailed, hands-on approach to the investigation of incidents in which computers or computer technology play a significant or interesting role. Students completing this course will be familiar with the core computer science theory and practical skills necessary to perform rudimentary computer forensic investigations, understand the role of technology in investigating computer-based crime, and be prepared to deal with investigative bodies at a rudimentary level. Course Objectives This is an introductory course in collecting, examining, and preserving digital evidence in support of criminal investigations, civil investigations, and sensitive business matters. The course examines the issues, tools, techniques, and processes needed to successfully prepare for, respond to, and investigate such matters. Students will receive a basic understanding of the broad cyber forensics discipline. Upon the successful completion of this course students will be able to: 1. Identify relevant electronic evidence (both inculpatory and exculpatory) associated with various violations of specific laws, including, but not limited to, computer crimes. 2. Articulate probable cause as necessary to obtain a warrant to search for electronic artifacts, and recognize the limits of warrants. 3. Seize electronic evidence at crime scene based on the warrant and preserve the evidence. 4. Recognize and maintain a chain of custody of electronic evidence. 5. Preserve and acquire electronic evidence using computer forensics tools. 6. Analyze electronic evidence using computer forensics tools. 7. Follow a documented forensics investigation process. 8. Understand basic file systems, computer data storage processes, etc. Topics Covered: 1. Overview of Computer Forensics 2. Computer Forensics Investigation 3. Computer Forensics Office and Lab 4. Fundamental of Computer Systems (Storage media and file systems) 5. Computer Forensics Tools 6. Process Crime and Incident Scenes 7. Digital Evidence Control 8. Static Data Acquisition and Analysis

2 9. Live Data Acquisition and Analysis 10. Investigation and Analysis 11. USB and Flash Memory Devices Analysis 12. Images Recovering and Analysis 13. Investigation Report Course Materials Textbooks: Guide to Computer Forensics and Investigations, 4 th edition, by Bill Nelson, Amelia Phillips, and Christopher Steuart, Thompson/Course Technology (ISBN: ) Books for reference: File System Forensic Analysis, by Brian Carrier, Addison Wesley (ISBN: ) Real Digital Forensics, Keith Jones, Richard Bejtlich and Curtis Rose (ISBN: ) References A Guide for Preparing Digital Evidence for Courtroom Presentation ( Federal Criminal Code ( Federal Rules of Evidence ( Electronic Crime Scene Investigation: A Guide for First Responders ( NIST National Software Reference Library ( Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations ( Sleuthkit and Autopsy ( ~~~~~~~~ Policies of the Course ~~~~~~~~ Prerequisite A C or better grade in CSCI 220 or approved by the department of computer science. Pre-class Reading Read the materials that are scheduled for discussion several times prior to attending the lecture. Attendance You are expected to be in class on time for each class meeting. Excessive absences may result in the lowering of your grade one letter. It is important to attend class regularly and on time because the instructor may: < give supplementary course material that is not in the text < announce changes pertaining to this course in class < give unannounced quizzes with no chance for a makeup < use attendance to qualify students for bonus activities

3 While you are attending the class, you are expected NOT TO < turn on the cellular phone < use the cellular phone < play games < surf the Internet unless you are instructed to do so < use any instant messenger or other means to chat with other users online < use of profane or inappropriate language Any violations to these rules will result in a 2 point deductions and/or disqualify you from bonus activities. Assignments Assignments are chosen to prepare you for practical and theory examinations in this course, requirements in other courses and work assignments in the real world. You are on your honor that the work you turn in is the work you have done by yourself. This is the foundation of your career as a computer scientist; therefore, take the time to develop the necessary professionalism as a productive citizen. Research Project Each student is required to choose a research topic related to digital forensics and submit a report of his/her research result. Forensics Challenge Project Students will be divided into groups of 3 to work on the project. Each group will have its own digital evidence to discover. A summary report will be submitted at the end of the semester. Late Work No late work is accepted!! The designated directory will be closed at the due time automatically. Afterwards, no student will be able to have access to his/her directory. Note: If you have a validated and documented excuse, the instructor reserves the right to accept it and allow the student to make up any work he or she missed. It is the student s responsibility to show the excuse and get permission to complete any assignments missed. The student should present the excuse the first day back in class and the student has one week to complete the make-up work. Reporting Errors in Grading The instructor will return graded work within one week of the day it is reported. If there are errors to be corrected or adjustments to be made in the grade assigned, you must present the paper for correction within one week of the date the graded paper is returned to the class. Exams and Quizzes No borrowing is allowed during quizzes or examinations. You should bring an adequate supply of pencils, paper, eraser, etc. to the exams; if you attempt to borrow materials during an exam you may be dismissed from that exam. If you miss one of the regular exams, your percentage score on the final exam will be used to determine the score for the missed exam; a zero score may be recorded for each exam missed after the first. There is no provision for making up quizzes.

4 Tentative Examination Schedule Two regular exams will be given during the semester. They are tentatively scheduled below. The time and place will be announced in class in case of changes. Exam Wednesday, October 5, 2011 Exam Wednesday, November 16, 2011 Grading Components Assignments & Quizzes Regular Exams Research Project Forensics Challenge Project Grading Scale Final grades will be assigned as a percentage of 700 total points as follows. 90% or more A 80% but less than 90% B 70% but less than 80% C 60% but less than 70% D Less than 60% E The grading policy as defined by the Office of Academic Affairs and the instructor of this course does not permit an I grade to be substituted for an impending failing grade.

5 ~~~~~ Expected Outcomes of the Course ~~~~~ Relationship of the course to program outcomes Program Outcomes (ABET criteria) a b c d e f g h i Objective 1 X X X X X X X X X Objective 2 X X X X X X X X Objective 3 X X X X X X X X X Objective 4 X X X X X X Objective 5 X X X X X X X X X Objective 6 X X X X X X X X X Objective 7 X X X X X Objective 8 X X X X X ABET criteria a. Apply knowledge of computing and mathematics appropriate to the discipline. b. Analyze a problem, and identify and define the computing requirements appropriate to its solution. c. Design, implement, and evaluate a computer-based system, process, component, or program to meet desired needs. d. Function effectively on teams to accomplish a common goal. e. Understanding of professional, ethical, and social responsibilities. f. Communicate effectively. g. Analyze the impact of computing on individuals, organizations, and society, including ethical, legal, security, and global policy issues. h. Recognition of the need for and an ability to engage in continuing professional development. i. Use current techniques, skills, and tools necessary for computing practice.