[major=IA | course_id=FRS301 | syllabus_id=11193 | semester=5 | combo=core | title=Digital Forensics]
Course ID: FRS301
Title EN: Digital Forensics
Title VI: Điều tra số
Credits: 3.0
Prerequisites: NWC202 or NWC203c or NWC204
Description: This course addresses the comprehension and application of Digital Forensic Investigations. Students will evaluate and synthesize technical and legal issues in relation to digital evidence. Students will apply various skills and techniques, combined with numerous investigative software tools to analyze seized electronic media. Students subject to background investigation prior to admittance.

Assessment scheme:

1) On-going Assessment
- 01 Midterm Progress Test: 20%
- Participation in Discussions: 10%
- 14 Lab-Projects: 40%
2) 01 Final Exam: 30%
3) Final Result 100%
Completion Criteria:
1) Every on-going assessment component >0
2) Average Lab Score >= 4
3) Final Exam Score >=4 & Final Result >=5
Student tasks: - Students must attend at least 80% of contact sessions in order to be accepted to the final examination.
- Students are responsible to do all exercises, assignments and labs given by instructor in class or at home and submit in time
- Use laptop in class only for learning purpose
- Promptly access to the FPTU LMS at https://flm.fpt.edu.vn/ for up-to-date course information
Tools: 
Course type: traditional
Decision: 358/QĐ-ĐHFPT dated 04/03/2024
Approved date: 2024-04-03
CLO1: Defining Digital Forensics and examining how it’s being used.
[1] category=Lab-Projects; type=on-going; weight=40.0; duration=60-90'/each; question_type=; grading_guide=technical aspect of studied topics; completion_criteria=; clos=4
[2] category=Midterm Progress Test; type=on-going; weight=20.0; duration=30'-40'; question_type=; grading_guide=cover Lectures 1-9; completion_criteria=; clos=>0
[3] category=Participation in Discussions; type=on-going; weight=10.0; duration=; question_type=; grading_guide=; completion_criteria=; clos=>0
[4] category=Final Exam; type=Final exam; weight=30.0; duration=60'; question_type=LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8, LO9, LO10; grading_guide=concepts, algorithms; all studied Chapters; completion_criteria=; clos=4
[1] desc=The Basics of Digital Forensics: The Primer for Getting Started in Digital Forensics
(Online: http://library.books24x7.com/toc.aspx?bookid=78129).; author=John Sammons; publisher=Syngress; edition=2nd; isbn=; main=True; online=True; note=
[2] desc=https://samsclass.info/121/121_S13.shtml; author=; publisher=; edition=; isbn=; main=; online=True; note=
[3] desc=Guide to Computer Forensics and Investigations Processing Digital Evidence; author=Bill Nelson, Amelia Phillips, Chris Steuart; publisher=Cengage Learning; edition=5th; isbn=; main=; online=; note=
[4] desc=Digital Forensics Trial Graphics: Teaching the Jury Though Effective Use of Visuals; author=John Sammons, Lars Daniel; publisher=Elsevier; edition=; isbn=; main=; online=; note=
[5] desc=Digital Forensics Processing and Procedures: Meeting the Requirements of ISO 17020, ISO 17025, ISO 27001 and Best Practice Requirements; author=David Watson, Andrew Jones; publisher=Syngress; edition=; isbn=; main=; online=; note=
[6] desc=Lecture slides, Lab-Projects.; author=; publisher=; edition=; isbn=; main=; online=; note=
Session 1: Lecture 1. Introduction
1.1 What is Forensic Science?
1.2 What is Digital Forensics?
Topic: Offline; Teaching type: LO1; LO: IT
ITU: 
Materials: mat1
Download: Explain Lab-Projects requirements
Read the Chapter
Study and Review Lecture 1

Session 2: Lecture 1. Introduction (cont.)
1.3 Uses of Digital Forensics
1.4 Role of the Forensic Examiner in the Judicial System
Topic: Offline; Teaching type: LO1; LO: IT
ITU: 
Materials: mat2
Download: Explain Lab-Projects requirements
Read the Chapter
Study and Review Lecture 1

Session 3: Lecture 2. Key Technical Concepts
2.1 Basic Computer Operation
2.2 File Extensions and File Signatures
Topic: Offline; Teaching type: LO2; LO: T
ITU: 
Materials: mat3
Download: Read the Chapter
Study and Review Lecture 2

Session 4: Lecture 2. Key Technical Concepts (cont.)
2.3 Storage and Memory
2.4 Computing Environments
Topic: Offline; Teaching type: LO2; LO: T
ITU: 
Materials: mat4
Download: Read the Chapter
Study and Review Lecture 2
CLO10: Understanding the underlying technology powering cell phones and GPS units, as well as the potential evidence they could contain.
Session 1: Lecture 3. Key Technical Concepts (cont.)
3.1 Data Types
3.2 File Systems
Topic: Offline; Teaching type: LO2; LO: T
ITU: 
Materials: mat5
Download: Read the Chapter
Study and Review Lecture 3

Session 2: Lecture 3. Key Technical Concepts (cont.)
3.3 Allocated and Unallocated Space
3.4 How Magnetic Hard Drives Store Data
3.5 Basic Computer Function - Putting It All Together
Topic: Offline; Teaching type: LO2; LO: T
ITU: 
Materials: mat6
Download: Read the Chapter
Study and Review Lecture 3

Session 3: Lab 1: Preparing a Windows Forensics Environment
Topic: Offline; Teaching type: LO2; LO: U
ITU: 
Materials: mat7
Download: Practice and Review Lab 1

Session 4: Lab 1: Preparing a Windows Forensics Environment (cont.)
Topic: Offline; Teaching type: LO2; LO: U
ITU: 
Materials: mat8
Download: Practice and Review Lab 1
CLO2: Understanding how computers create and store digital information is a perquisite for the study of digital forensics.
Session 1: Lab 2: Using ProDiscover
Topic: Offline; Teaching type: LO2; LO: U
ITU: 
Download: Practice and Review Lab 2

Session 2: Lab 2: Using ProDiscover (cont.)
Topic: Offline; Teaching type: LO2; LO: U
ITU: 
Download: Practice and Review Lab 2

Session 3: Lecture 4. Labs and Tools
3.1 Forensic Laboratories
3.2 Policies and Procedures
Topic: Offline; Teaching type: LO3; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 4

Session 4: Lecture 4. Labs and Tools (cont.)
3.3 Quality Assurance
3.4 Digital Forensic Tools
3.5 Accreditation
Topic: Offline; Teaching type: LO3; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 4
CLO3: Examining digital forensic environment, hardware and software, and standards used on a regular basis, to accredit labs and validate tools.
Session 1: Lab-Project 3: Identifying File Types
Topic: Offline; Teaching type: LO3; LO: U
ITU: 
Download: Practice and Review Lab 3

Session 2: Lab-Project 3: Identifying File Types (cont.)
Topic: Offline; Teaching type: LO3; LO: U
ITU: 
Download: Practice and Review Lab 3

Session 3: Lecture 5. Collecting Evidence
4.1 Crime Scenes and Collecting Evidence
Topic: Offline; Teaching type: LO4; LO: T
ITU: 
Download: Read the Chapter
Study nad Review Lecture 5

Session 4: Lecture 5. Collecting Evidence (cont.)
4.2 Documenting the Scene
4.3 Chain of Custody
Topic: Offline; Teaching type: LO4; LO: T
ITU: 
Download: Read the Chapter
Study nad Review Lecture 5
CLO4: Collecting digital evidence, establishing a chain of custody, and understanding its major role when admitted into court.
Session 1: Lecture 6. Collecting Evidence (cont.)
5.1 Cloning
5.2 Live System versus Dead System
Topic: Offline; Teaching type: LO4; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 6

Session 2: Lecture 6. Collecting Evidence (cont.)
5.3 Hashing
5.4 Final Report
Topic: Offline; Teaching type: LO4; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 6

Session 3: Lab-Project 4: Viewing Segments and Clusters with a Hex Editor
Topic: Offline; Teaching type: LO4; LO: U
ITU: 
Download: Practice and Review Lab 4

Session 4: Lab-Project 4: Viewing Segments and Clusters with a Hex Editor (cont.)
Topic: Offline; Teaching type: LO4; LO: U
ITU: 
Download: Practice and Review Lab 4
CLO5: Understanding many of the common Windows artifacts and how they are created.
Session 1: Lab-Project 5: Static Image
Topic: Offline; Teaching type: LO4; LO: U
ITU: 
Download: Practice and Review Lab 5

Session 2: Lab-Project 5: Static Image (cont.)
Topic: Offline; Teaching type: LO4; LO: U
ITU: 
Download: Practice and Review Lab 5

Session 3: Lecture 7. Windows System Artifacts
6.1 Deleted Data
6.2 Hibernation File (Hiberfile.Sys)
Topic: Offline; Teaching type: LO5; LO: T
ITU: 
Download: Read the Chapter
Study nad Review Lecture 7

Session 4: Lecture 7. Windows System Artifacts (cont.)
6.3 Registry
6.4 Print Spooling
6.5 Recycle Bin
Topic: Offline; Teaching type: LO5; LO: T
ITU: 
Download: Read the Chapter
Study nad Review Lecture 7
CLO6: Examining tools and techniques used to hide or destroy data with the aim to recover digital evidence, deleted files, and the like.
Session 1: Lecture 8. Windows System Artifacts (cont.)
7.1 Metadata
7.2 Thumbnail Cache
Topic: Offline; Teaching type: LO5; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 8

Session 2: Lecture 8. Windows System Artifacts (cont.)
7.3 Most Recently Used (MRU)
7.4 Restore Points and Shadow Copy
7.5 Prefetch and Link Files
Topic: Offline; Teaching type: LO5; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 8

Session 3: Lab-Project 6: Examining the Registry
Topic: Offline; Teaching type: LO5; LO: U
ITU: 
Download: Practice and Review Lab 6

Session 4: Lab-Project 6: Examining the Registry (cont.)
Topic: Offline; Teaching type: LO5; LO: U
ITU: 
Download: Practice and Review Lab 6
CLO7: Explaining the legal aspects of digital forensics in searching.
Session 1: Lab-Project 7: Thumbnail Cache
Topic: Offline; Teaching type: LO5; LO: U
ITU: 
Download: Practice and Review Lab 7

Session 2: Lab-Project 7: Thumbnail Cache (cont.)
Topic: Offline; Teaching type: LO5; LO: U
ITU: 
Download: Practice and Review Lab 7

Session 3: Lectures 9. Antiforensics
8.1 Hiding Data
8.2 Password Attacks
Topic: Offline; Teaching type: LO6; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 9

Session 4: Lectures 9. Antiforensics (cont.)
8.3 Steganography
8.4 Data Destruction
Recommended Reading: The Cryptocurrency Enigma
Topic: Offline; Teaching type: LO6; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 9
CLO8: Understanding social networks, e-mail, chat logs, and Internet history representing some of the best evidence.
Session 1: Lab-Project 8: Bypassing a BIOS Password
Topic: Offline; Teaching type: LO6; LO: U
ITU: 
Download: Practice and Review Lab 8

Session 2: Lab-Project 8: Bypassing a BIOS Password (cont.)
Topic: Offline; Teaching type: LO6; LO: U
ITU: 
Download: Practice and Review Lab 8

Session 3: Lab-Project 9: Capturing Passwords from RAM on a Mac
Topic: Offline; Teaching type: LO6; LO: U
ITU: 
Download: Practice and Review Lab 9

Session 4: Lab-Project 9: Capturing Passwords from RAM on a Mac (cont.)
Topic: Offline; Teaching type: LO6; LO: U
ITU: 
Download: Practice and Review Lab 9
CLO9: Understanding how networks are attacked and what role digital forensics plays in not only the response, but in how perpetrators can be traced.
Session 1: Review for Midterm
Topic: Offline; Teaching type: LO1, LO2, LO3, LO4, LO5, LO6; LO: U
ITU: 

Session 2: Midterm Progress Test
Topic: Offline; Teaching type: ; LO: 
ITU: 

Session 3: Lectures 10. Legal Aspects of Digital Forensics
9.1 The Fourth Amendment
9.2 Criminal Law - Searches with and without a Warrant
Topic: Offline; Teaching type: LO7; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 10

Session 4: Lectures 10. Legal Aspects of Digital Forensics (cont.)
9.3 Electronic Discovery (eDiscovery)
9.4 Expert Testimony
Recommended Reading: Digital Forensics Trial Graphics - Teaching the Jury Though Effective Use of Visuals
Topic: Offline; Teaching type: LO7; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 10
Session 1: Lab-Project 10: Static Acquisition with Kali Linux
Topic: Offline; Teaching type: LO7; LO: U
ITU: 
Download: Practice and Review Lab 10

Session 2: Lab-Project 10: Static Acquisition with Kali Linux (cont.)
Topic: Offline; Teaching type: LO7; LO: U
ITU: 
Download: Practice and Review Lab 10

Session 3: Lectures 11. Internet and E-Mail
11.1 Internet Overview
11.2 Web Browsers - Internet Explorer
Topic: Offline; Teaching type: LO8; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 11

Session 4: Lectures 11. Internet and E-Mail (cont.)
11.3 E-Mail
11.4 Social Networking Sites
Topic: Offline; Teaching type: LO8; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 11
Session 1: Lab-Project 11: Using FTK , or Using Median
Topic: Offline; Teaching type: LO8; LO: U
ITU: 
Download: Practice and Review Lab 11

Session 2: Lab-Project 11: Using FTK , or Using Median (cont.)
Topic: Offline; Teaching type: LO8; LO: U
ITU: 
Download: Practice and Review Lab 11

Session 3: Lectures 12. Digital Forensics and Networking
12.1 Network Fundamentals
12.2 Network Security Tools
Topic: Offline; Teaching type: LO9; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 12

Session 4: Lectures 12. Digital Forensics and Networking (cont.)
12.3 Network Attacks
12.4 Incident Response
12.5 Network Evidence and Investigations
Topic: Offline; Teaching type: LO9; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 12
Session 1: Lab-Project 12: The Sleuth Kit and Autopsy
Topic: Offline; Teaching type: LO9; LO: U
ITU: 
Download: Practice and Review Lab 12

Session 2: Lab-Project 12: The Sleuth Kit and Autopsy (cont.)
Topic: Offline; Teaching type: LO9; LO: U
ITU: 
Download: Practice and Review Lab 12

Session 3: Lectures 13. Mobile Device Forensics
13.1 Cellular Networks
13.2 Overview of Cell Phone Operating Systems
Topic: Offline; Teaching type: LO10; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 13

Session 4: Lectures 13. Mobile Device Forensics (cont.)
13.3 Cell Phone Evidence
Topic: Offline; Teaching type: LO10; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 13
Session 1: Lectures 14. Mobile Device Forensics (cont.)
14.1 Cell Phone Forensic Tools
Topic: Offline; Teaching type: LO10; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 14

Session 2: Lectures 14. Mobile Device Forensics (cont.)
14.2 Global Positioning Systems (GPS)
Recommended Reading: Challenges and Concerns
Topic: Offline; Teaching type: LO10; LO: T
ITU: 
Download: Read the Chapter
Study and Review Lecture 14

Session 3: Lab-Project 13: Using Netwitness
Topic: Offline; Teaching type: LO10; LO: U
ITU: 
Download: Practice and Review Lab 13

Session 4: Lab-Project 13: Using Netwitness (cont.)
Topic: Offline; Teaching type: LO10; LO: U
ITU: 
Download: Practice and Review Lab 13
Session 1: Lab-Project 14: Finding Items with NetWitness
Topic: Offline; Teaching type: LO10; LO: U
ITU: 
Download: Practice and Review Lab 14

Session 2: Lab-Project 14: Finding Items with NetWitness (cont.)
Topic: Offline; Teaching type: LO10; LO: U
ITU: 
Download: Practice and Review Lab 14

Session 3: Course Review
Topic: Offline; Teaching type: ; LO: U
ITU: 
Download: Review the course

Session 4: Course Review (cont.)
Topic: Offline; Teaching type: ; LO: U
ITU: 
Download: Review the course
Session 1: Final Exam
Topic: ; Teaching type: ; LO: 
ITU: