Digital Forensics

Catalog description

This course introduces students to the concepts of digital forensics. Digital forensics is a branch of forensic science encompassing the preservation, identification, recovery, investigation, examination, and analysis of material found in digital devices (networks, memory, operating systems files, etc.). Digital forensics can be used to aid in criminal investigations, accident investigations, corporate breach investigations, and other cybersecurity incidents. The course introduces students to acceptable approaches for collecting, analyzing, and reporting data from a forensics investigation. Students will be required to perform several forensics analyses in a controlled lab environment, including acquiring forensically sound hard drive images, memory images and analyzing these using industry standard tools. Students will also be exposed to the types of forensic data that may be left on mobile devices, IoT devices, and other embedded systems, and be able to explain the techniques used on these devices to obtain forensic data.