Digital Forensics (FRS301)
Vietnamese title: Điều tra số
Credits: 3
Prerequisites: NWC202 or NWC203c or NWC204

Description:
This course addresses the comprehension and application of Digital Forensic Investigations. Students will evaluate and synthesize technical and legal issues in relation to digital evidence. Students will apply various skills and techniques, combined with numerous investigative software tools to analyze seized electronic media. Students subject to background investigation prior to admittance.

Assessment scheme:

1) On-going Assessment
- 01 Midterm Progress Test: 20%
- Participation in Discussions: 10%
- 14 Lab-Projects: 40%
2) 01 Final Exam: 30%
3) Final Result 100%
Completion Criteria:
1) Every on-going assessment component >0
2) Average Lab Score >= 4
3) Final Exam Score >=4 & Final Result >=5

Learning outcomes:
Defining Digital Forensics and examining how it’s being used.
Understanding the underlying technology powering cell phones and GPS units, as well as the potential evidence they could contain.
Understanding how computers create and store digital information is a perquisite for the study of digital forensics.
Examining digital forensic environment, hardware and software, and standards used on a regular basis, to accredit labs and validate tools.
Collecting digital evidence, establishing a chain of custody, and understanding its major role when admitted into court.
Understanding many of the common Windows artifacts and how they are created.
Examining tools and techniques used to hide or destroy data with the aim to recover digital evidence, deleted files, and the like.
Explaining the legal aspects of digital forensics in searching.
Understanding social networks, e-mail, chat logs, and Internet history representing some of the best evidence.
Understanding how networks are attacked and what role digital forensics plays in not only the response, but in how perpetrators can be traced.

Student tasks:
- Students must attend at least 80% of contact sessions in order to be accepted to the final examination.
- Students are responsible to do all exercises, assignments and labs given by instructor in class or at home and submit in time
- Use laptop in class only for learning purpose
- Promptly access to the FPTU LMS at https://flm.fpt.edu.vn/ for up-to-date course information

Tools:

Materials:
description: The Basics of Digital Forensics: The Primer for Getting Started in Digital Forensics
(Online: http://library.books24x7.com/toc.aspx?bookid=78129).
author: John Sammons
publisher: Syngress
published_date: 2015
edition: 2nd
description: https://samsclass.info/121/121_S13.shtml
description: Guide to Computer Forensics and Investigations Processing Digital Evidence
author: Bill Nelson, Amelia Phillips, Chris Steuart
publisher: Cengage Learning
published_date: 2016
edition: 5th
description: Digital Forensics Trial Graphics: Teaching the Jury Though Effective Use of Visuals
author: John Sammons, Lars Daniel
publisher: Elsevier
published_date: 2017
description: Digital Forensics Processing and Procedures: Meeting the Requirements of ISO 17020, ISO 17025, ISO 27001 and Best Practice Requirements
author: David Watson, Andrew Jones
publisher: Syngress
published_date: 2013
description: Lecture slides, Lab-Projects.

Assessments:
category: Lab-Projects
type: on-going
weight: 40.0
duration: 60-90'/each
no_question: practical exercises
grading_guide: technical aspect of studied topics
note: Guided by instructor
- 14 Lab-Projects are arranged relevant to the chapter theory
- Student must finish labs and submit the results to the lecturer in class.
- An average point of all labs could be evaluated and published to students at the end of the semester.
category: Midterm Progress Test
type: on-going
weight: 20.0
duration: 30'-40'
no_question: Multiple choices Marked by Computer or a suitable format
knowledge_and_skill: 20-25
grading_guide: cover Lectures 1-9
note: in class, by instructor
category: Participation in Discussions
type: on-going
weight: 10.0
category: Final Exam
type: Final exam
weight: 30.0
duration: 60'
question_type: LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8, LO9, LO10
no_question: Multiple choices
knowledge_and_skill: 40-50
grading_guide: concepts, algorithms; all studied Chapters
note: by exam board, using computer

Schedule:
session: Lecture 1. Introduction
1.1 What is Forensic Science?
1.2 What is Digital Forensics?
learning_outcomes: IT
materials: mat1
session: Lecture 1. Introduction (cont.)
1.3 Uses of Digital Forensics
1.4 Role of the Forensic Examiner in the Judicial System
learning_outcomes: IT
materials: mat2
session: Lecture 2. Key Technical Concepts
2.1 Basic Computer Operation
2.2 File Extensions and File Signatures
learning_outcomes: T
materials: mat3
session: Lecture 2. Key Technical Concepts (cont.)
2.3 Storage and Memory
2.4 Computing Environments
learning_outcomes: T
materials: mat4
session: Lecture 3. Key Technical Concepts (cont.)
3.1 Data Types
3.2 File Systems
learning_outcomes: T
materials: mat5
session: Lecture 3. Key Technical Concepts (cont.)
3.3 Allocated and Unallocated Space
3.4 How Magnetic Hard Drives Store Data
3.5 Basic Computer Function - Putting It All Together
learning_outcomes: T
materials: mat6
session: Lab 1: Preparing a Windows Forensics Environment
learning_outcomes: U
materials: mat7
session: Lab 1: Preparing a Windows Forensics Environment (cont.)
learning_outcomes: U
materials: mat8
session: Lab 2: Using ProDiscover
learning_outcomes: U
session: Lab 2: Using ProDiscover (cont.)
learning_outcomes: U
session: Lecture 4. Labs and Tools
3.1 Forensic Laboratories
3.2 Policies and Procedures
learning_outcomes: T
session: Lecture 4. Labs and Tools (cont.)
3.3 Quality Assurance
3.4 Digital Forensic Tools
3.5 Accreditation
learning_outcomes: T
session: Lab-Project 3: Identifying File Types
learning_outcomes: U
session: Lab-Project 3: Identifying File Types (cont.)
learning_outcomes: U
session: Lecture 5. Collecting Evidence
4.1 Crime Scenes and Collecting Evidence
learning_outcomes: T
session: Lecture 5. Collecting Evidence (cont.)
4.2 Documenting the Scene
4.3 Chain of Custody
learning_outcomes: T
session: Lecture 6. Collecting Evidence (cont.)
5.1 Cloning
5.2 Live System versus Dead System
learning_outcomes: T
session: Lecture 6. Collecting Evidence (cont.)
5.3 Hashing
5.4 Final Report
learning_outcomes: T
session: Lab-Project 4: Viewing Segments and Clusters with a Hex Editor
learning_outcomes: U
session: Lab-Project 4: Viewing Segments and Clusters with a Hex Editor (cont.)
learning_outcomes: U
session: Lab-Project 5: Static Image
learning_outcomes: U
session: Lab-Project 5: Static Image (cont.)
learning_outcomes: U
session: Lecture 7. Windows System Artifacts
6.1 Deleted Data
6.2 Hibernation File (Hiberfile.Sys)
learning_outcomes: T
session: Lecture 7. Windows System Artifacts (cont.)
6.3 Registry
6.4 Print Spooling
6.5 Recycle Bin
learning_outcomes: T
session: Lecture 8. Windows System Artifacts (cont.)
7.1 Metadata
7.2 Thumbnail Cache
learning_outcomes: T
session: Lecture 8. Windows System Artifacts (cont.)
7.3 Most Recently Used (MRU)
7.4 Restore Points and Shadow Copy
7.5 Prefetch and Link Files
learning_outcomes: T
session: Lab-Project 6: Examining the Registry
learning_outcomes: U
session: Lab-Project 6: Examining the Registry (cont.)
learning_outcomes: U
session: Lab-Project 7: Thumbnail Cache
learning_outcomes: U
session: Lab-Project 7: Thumbnail Cache (cont.)
learning_outcomes: U
session: Lectures 9. Antiforensics
8.1 Hiding Data
8.2 Password Attacks
learning_outcomes: T
session: Lectures 9. Antiforensics (cont.)
8.3 Steganography
8.4 Data Destruction
Recommended Reading: The Cryptocurrency Enigma
learning_outcomes: T
session: Lab-Project 8: Bypassing a BIOS Password
learning_outcomes: U
session: Lab-Project 8: Bypassing a BIOS Password (cont.)
learning_outcomes: U
session: Lab-Project 9: Capturing Passwords from RAM on a Mac
learning_outcomes: U
session: Lab-Project 9: Capturing Passwords from RAM on a Mac (cont.)
learning_outcomes: U
session: Review for Midterm
learning_outcomes: U
session: Midterm Progress Test
session: Lectures 10. Legal Aspects of Digital Forensics
9.1 The Fourth Amendment
9.2 Criminal Law - Searches with and without a Warrant
learning_outcomes: T
session: Lectures 10. Legal Aspects of Digital Forensics (cont.)
9.3 Electronic Discovery (eDiscovery)
9.4 Expert Testimony
Recommended Reading: Digital Forensics Trial Graphics - Teaching the Jury Though Effective Use of Visuals
learning_outcomes: T
session: Lab-Project 10: Static Acquisition with Kali Linux
learning_outcomes: U
session: Lab-Project 10: Static Acquisition with Kali Linux (cont.)
learning_outcomes: U
session: Lectures 11. Internet and E-Mail
11.1 Internet Overview
11.2 Web Browsers - Internet Explorer
learning_outcomes: T
session: Lectures 11. Internet and E-Mail (cont.)
11.3 E-Mail
11.4 Social Networking Sites
learning_outcomes: T
session: Lab-Project 11: Using FTK , or Using Median
learning_outcomes: U
session: Lab-Project 11: Using FTK , or Using Median (cont.)
learning_outcomes: U
session: Lectures 12. Digital Forensics and Networking
12.1 Network Fundamentals
12.2 Network Security Tools
learning_outcomes: T
session: Lectures 12. Digital Forensics and Networking (cont.)
12.3 Network Attacks
12.4 Incident Response
12.5 Network Evidence and Investigations
learning_outcomes: T
session: Lab-Project 12: The Sleuth Kit and Autopsy
learning_outcomes: U
session: Lab-Project 12: The Sleuth Kit and Autopsy (cont.)
learning_outcomes: U
session: Lectures 13. Mobile Device Forensics
13.1 Cellular Networks
13.2 Overview of Cell Phone Operating Systems
learning_outcomes: T
session: Lectures 13. Mobile Device Forensics (cont.)
13.3 Cell Phone Evidence
learning_outcomes: T
session: Lectures 14. Mobile Device Forensics (cont.)
14.1 Cell Phone Forensic Tools
learning_outcomes: T
session: Lectures 14. Mobile Device Forensics (cont.)
14.2 Global Positioning Systems (GPS)
Recommended Reading: Challenges and Concerns
learning_outcomes: T
session: Lab-Project 13: Using Netwitness
learning_outcomes: U
session: Lab-Project 13: Using Netwitness (cont.)
learning_outcomes: U
session: Lab-Project 14: Finding Items with NetWitness
learning_outcomes: U
session: Lab-Project 14: Finding Items with NetWitness (cont.)
learning_outcomes: U
session: Course Review
learning_outcomes: U
session: Course Review (cont.)
learning_outcomes: U
session: Final Exam