Core Module Information
Module title: Digital Forensics

SCQF level: 08:
SCQF credit value: 20.00
ECTS credit value: 10

Module code: CSN08411
Module leader: Petra Leimich
School School of Computing, Engineering and the Built Environment
Subject area group: Cyber Security and Systems Engineering

Module Code CSN07401
Examples of Equivalent Learning Knowledge of essential computer architecture such as memory, operating systems, binary and hexadecimal numbers.

Description of module content:

12. Module Content

The aim of the module is to investigate the principles of digital forensics, focusing on computer forensics (client-side PCs and laptops). The module includes significant practical sessions in applying computer forensics in realistic real-world scenarios, allowing students to analyse and evaluate digital evidence through the use of forensic tools and techniques. The tools examined will be mainly public domain tools. The practicals will be complemented with considerable theoretical
knowledge of computer information as digital evidence and the basic techniques associated with gathering, preserving and presenting digital evidence. Outlines of the main areas include:
? Introduction to concepts of Computer Forensics and Digital Forensics with respect to digital evidence
? Introduction to principles involved in Digital Forensic investigations
? Ethical and professional issues related to Digital Forensics
? Introduction to forensic techniques used in the examination of end-devices covering boot disks, file systems, system registry, timeline of events, web browsers, email, log files, etc.
?Introduction to open-source forensic tools (e.g. Autopsy).

Learning Outcomes for module:

Upon completion of this module you will be able to
LO1: Discuss the principles of computer and digital forensics
LO2: Conduct a digital forensic investigation in an ethical and professional manner
LO3: Evaluate digital evidence obtained during forensic investigations using forensic tools
LO4: Develop an understanding of relevant digital forensic literature and quality information sources.

Full Details of Teaching and Assessment
2022/3, Trimester 2, FACE-TO-FACE, Edinburgh Napier University
Occurrence: 001
Primary mode of delivery: FACE-TO-FACE
Location of delivery: MERCHISTON
Partner: Edinburgh Napier University
Member of staff responsible for delivering module: Petra Leimich
Module Organiser:

Learning, Teaching and Assessment (LTA) Approach:
The student is required to be employed as a Graduate Apprentice based in and around Edinburgh to be eligible to complete this module, in this format. This module is offered in day release (GA) study mode and will be delivered during the period that students are attending classes from 9 am to 5 pm, one day per week. The delivery of the module is in line with normal university delivery models. The traditional lecture materials will be delivered in a blended form using online materials, while in-class time is devoted to practical exercises, projects, or discussions. The module is designed around online and student-centred learning in practice with an emphasis on building a learning community.

The general approach in this module is to make use of lectures to cover theoretical and practical forensic issues, and use practical sessions to analyse and evaluate digital forensic scenarios using tools and current industry practice. These practical lab-based sessions will concentrate on the use of computer forensics tools in the analysis of case studies [LO3 and 4], allowing students to gain an understanding of forensic investigation techniques [LO2]. Where appropriate, expert guest lectures and topical current real-world examples will be used. The theoretical material in lectures will be applied by students within the practical sessions, and reinforced through analysis and discussions activities [LO1, 2, 4].

Formative Assessment:
Interactive elements of lectures encourage students to test their understanding continuously. There will be additional formative challenges such as quizzes. Practical sessions are used to provide formative feedback for students on the module. During these sessions, module tutors assess and evaluate student performance on tasks relevant to the summative assessment, providing timely feedback which supports the development of students’ capabilities. The formative exercises and associated feedback shall also help students prepare for the summative assessments.
To support the summative assessments further, practice tests will be available with immediate, automated feedback.

Summative Assessment:
• Short answer class test: Class test relates to the fundamental material covered by the core academic material [LO1, LO2], as well as an understanding of current forensic literature [LO4]. Carried out using a moodle quiz during scheduled classes.
• practical skills assessment: relates to the digital investigation of a given scenario. Students will be required to perform a forensic investigation and analyse their findings [LO2, LO3]. It is expected that this will be in the format of an open book class test.

Student Activity (Notional Equivalent Study Hours (NESH))
Mode of activityLearning & Teaching ActivityNESH (Study Hours)
Face To Face Lecture 24
Face To Face Practical classes and workshops 24
Independent Learning Guided independent study 152
Total Study Hours200
Expected Total Study Hours for Module200

Type of Assessment Weighting % LOs covered Week due Length in Hours/Words
Centrally Time Tabled Examination 50 1,2,4 7 HOURS= 1.5, WORDS= 0
Practical Skills Assessment 50 2,3 14 HOURS= 1.5, WORDS= 0
Component 1 subtotal: 100
Component 2 subtotal: 0
Module subtotal: 100

Indicative References and Reading List - URL:
Digital Forensics CSN08x11