Unix-based System Forensics

Catalog description

This course is designed to provide students with the ability to identify and employ forensics techniques for gathering, preserving and analyzing evidence on Unix-based systems, and to report the pertinent evidence to the courts. The course emphasizes both the fundamental computer forensics procedures and the hands-on experience of utilizing forensics tools to uncover pertinent evidence from memory, allocated and unallocated space, and other Unix artifacts including log files, deleted files, browser history, emails, etc. Students will also follow and practice the forensically-sound procedures to ensure evidence admissibility in court.