Applied Digital Forensics

Catalog description

The course introduces the core terminology and concepts regarding the proper preservation of digital evidence. It will explain Locard's Exchange Principle, the importance of precise chain-of-custody and detailed documentation during the data collection efforts, the importance of proper metadata preservation and the investigative use of that metadata. The course will transition to hands-on work using actual digital forensic tools. The students will collect pre-created evidence (email and file system), document their work with the tools and in their own notes. They will perform basic analyses, they will complete chain-of-custody forms, supply the logs generated by their use of the tools, and then answer questions on the evidence, their findings, and these processes over the course of the semester.