CSI 220W - Digital Forensics II

Credits: 3

Develops skills in the theory behind forensic procedures, including: imaging, authentication, examination of Windows file systems, partitioning, and the registry hive. Provides an introduction to mobile device, SSD, and cloud based forensics.

Prerequisite(s): CSI 110W and CSI 120W both with a grade of “C” or better.
Corequisite(s): None
Lecture Hours: 45 Lab Hours: 0
Meets MTA Requirement: None
Pass/NoCredit: Yes

Outcomes and Objectives

Demonstrate how to image a physical device.
1. Acquire a valid forensic image.
2. Verify forensic image using several one-way cryptographic hashes.
Identify system structures.
1. Identify the components of the NTFS file system.
2. Identify the MFT and its components.
Demonstrate an understanding of various file systems or media concepts.
1. Demonstrate an understanding of allocated vs unallocated spaces.
2. Analyze slack space.
3. Demonstrate an understanding of sectors vs. clusters.
4. Demonstrate an understanding of partitioning schemes.
Identify forensic issues with mobile devices and their operating systems.
Utilize various programs to recover data from a smartphone.
Interrogate third-party applications for digital evidence.
Demonstrate how to work with locked or encrypted devices, applications, or containers.
Identify issues associated with forensic investigations of solid state drives.
Apply forensic concepts to the preservations of cloud-based storage.