Course content

• Digital investigations, stakeholders and their roles.
• Digital evidence, e.g. acquisition, admissibility, authenticity.
• Chain of custody, evidence integrity and forensic soundness.
• File and live system forensics.
• Timeline analysis.
• Forensic reconstructions.
• Internet and network forensics.
• Automation and forensic tools.
• Reporting and presenting evidence.
• Expert witness and cyber crime law.
• Computational forensics.
• Forensic readiness.
• Advanced topics if time permits.

Learning outcome

Knowledge:

• Digital Forensics methodology with a solid understanding of requirements for handling digital evidence.
• Requirements and impact on maintaining evidence integrity and chain of custody.
• Principles, procedures, and the basic concepts of forensic standards and best practices, e.g. forensic tool testing.
• The overall process for establishment and maintenance of a digital forensic lab environment.
• The role of expert witnesses and digital evidence in the context of legal proceedings.
• The part of policies, standards and guidelines for controls and is capable of applying their knowledge in case studies.
• Legal, privacy and ethical aspects of digital forensics investigations.

Skills:

• Forensic acquisition of digital evidence from a computer and network media.
• Live system forensics and evaluation of order of volatility.
• Evidence analysis with timeline analysis and forensic reconstruction.
• Scientific documentation of forensic acquisition and analysis.
• Applying forensic principles on practical case studies.
• Performing stakeholder analysis, risk assessment and forensic triage on limited case-studies.
• Evaluating the applicability of forensic methods and tools for various controls given a specific scope and policy for the control.

General competence:

• Capability of analyzing business, legal, ethical and case-specific requirements for planning and conducting a digital forensics investigation.
• Understanding of forensic analysis and incident response processes.
• Working independently and familiarity with digital forensics terminology.
• Capability of discussing professional problems such as documentation, decision-making processes, implementation plans, operations, reviews and corrective actions, with forensic experts, IT specialists and general managers.
• Learning skills to continue acquiring new knowledge and skills in a largely self-directed manner.
• Ability to contribute to innovative thinking and innovation processes.
• Active participation and collaboration within a group setting.

Learning methods and activities

• Lectures.
• Group work.
• Laboratory work.
• Asynchronous e-learning.
• Guest lectures (occasionally).
• Other exercises (if time permits).

Additional information:

• The course offers flexibility for both on-campus and remote students. Lectures will be conducted in person on the Gjøvik campus and will be streamed/recorded to remote students.
• Lectures and other types of learning material, such as recordings of lectures, will be offered through our Learning Management System (LMS), i.e. Blackboard.
• Communication between the teachers and the students, and among the students, will be facilitated by the LMS.
• Completion and submission of mandatory group assignments (approved/not approved) and a final group report are required. Specific requirements for these assignments will be communicated to students through the LMS.
• If individual participation and contributions within a group are uneven, or if some students do not complete their assigned tasks, the course coordinator may take corrective actions. This could include evaluating individual performance separately, which may result in individual grades for the group work component.
• Laboratory sessions will be conducted on-campus at the Gjøvik campus to provide hands-on experience. Participation in these sessions is not mandatory, and they will be streamed/recorded to ensure accessibility for remote students.

Compulsory assignments

• Mandatory group assignment

Specific conditions

Course materials

Coursebook: Årnes, André, ed. Digital forensics. John Wiley & Sons, 2017.

Other learning material such as conference/journal research articles, (guest) lectures, and other supplementary materials are available via LMS.

Credit reductions