Modules

Module title: Digital Forensics
SCQF level: 08:
SCQF credit value: 20.00
ECTS credit value: 10
Module code: CSN08111
Module leader: Petra Leimich
School School of Computing
Subject area group: Cyber Security and Networking
Prerequisites

Module Code CSN07101
Examples of Equivalent Learning Knowledge of essential computer architecture such as memory, operating systems, binary and hexadecimal numbers.
2019/0, Trimester 2, Face-to-Face, Edinburgh Napier University
Occurrence: 001
Primary mode of delivery: Face-to-Face
Location of delivery: MERCHISTON
Partner: Edinburgh Napier University
Member of staff responsible for delivering module: Petra Leimich
Module Organiser:


Learning, Teaching and Assessment (LTA) Approach:
Learning and Teaching Methods Including Their Alignment to LOs
The general approach in this module is to make use of lectures to cover theoretical and practical forensic issues, and use practical sessions to analyse and evaluate digital forensic scenarios using tools and current industry practice. These practical lab-based sessions will concentrate on the use of computer forensics tools in the analysis of case studies [LO3 and 4], allowing students to gain an understanding of forensic investigation techniques [LO2]. Where appropriate, expert guest lectures and topical current real-world examples will be used. The theoretical material in lectures will be applied by students within the practical sessions, and reinforced through analysis and discussions activities [LO1, 2, 4].

Formative Assessment:
Interactive elements of lectures encourage students to test their understanding continuously. There will be additional formative challenges such as quizzes. Continuous feedback is given by staff through discussions in the labs. Practical sessions are used to provide formative feedback for students on the module. During these sessions, module tutors assess and evaluate student performance on tasks relevant to the summative assessment, providing timely feedback which supports the development of students’ capabilities. The formative exercises and associated feedback shall also help students prepare for the summative assessments.
To support the summative assessments further, practice tests will be available with immediate, automated feedback.
Summative Assessment:
• Short answer class test: Class test relates to the fundamental material covered by the core academic material [LO1, LO2], and an understanding of current forensic literature [LO4]. Carried out using a moodle quiz during scheduled classes.
• practical skills assessment: relates to the digital investigation of a given scenario. Students will be required to perform a forensic investigation and analyse their findings [LO2, LO3,]. It is expected that this will be in the format of an open book class test.
Student Activity (Notional Equivalent Study Hours (NESH))
Mode of activityLearning & Teaching ActivityNESH (Study Hours)
Face To Face Lecture 24
Face To Face Practical classes and workshops 24
Independent Learning Guided independent study 152
Total Study Hours200
Expected Total Study Hours for Module200


Assessment
Type of Assessment Weighting % LOs covered Week due Length in Hours/Words
Digital Examination (not Centrally Timetabled) 50 1,2,4 7 HOURS= 1.5, WORDS= 0
Practical Skills Assessment 50 2,3 14 HOURS= 1.5, WORDS= 0
Component 1 subtotal: 100
Component 2 subtotal: 0
Module subtotal: 100

Description of module content:

12. Module Content

The aim of the module is to investigate the principles of digital forensics, focusing on computer forensics (client-side PCs and laptops). The module includes significant practical sessions in applying computer forensics in realistic real-world scenarios, allowing students to analyse and evaluate digital evidence through the use of forensic tools and techniques. The tools examined will be mainly public domain tools. The practicals will be complemented with considerable theoretical knowledge of computer information as digital evidence and the basic techniques associated with gathering, preserving and presenting digital evidence. Outlines of the main areas include:
? Introduction to concepts of Computer Forensics and Digital Forensics with respect to digital evidence
? Introduction to principles involved in Digital Forensic investigations
? Ethical and professional issues related to Digital Forensics
? Introduction to forensic techniques used in the examination of end-devices covering boot disks, file systems, system registry, timeline of events, web browsers, email, log files, etc.
?Introduction to open-source forensic tools (e.g. Autopsy).
Learning Outcomes for module:

Upon completion of this module you will be able to
LO1: Discuss the principles of computer and digital forensics
LO2: Conduct a digital forensic investigation in an ethical and professional manner
LO3: Evaluate digital evidence obtained during forensic investigations using forensic tools.
LO4: Develop an understanding of relevant digital forensic literature and quality information sources.
Indicative References and Reading List - URL:
Digital Forensics CSN08x11
 

Related information