CSI 120W - Digital Forensics I

Credits: 3

Examines theory and practices of digital forensics, including: sound forensic procedures, evidence handling, how to create and verify a forensic copy, identification of file and system types, data carving, manual recovery of files, and performance of logical and physical analysis. Credit may be earned in CSI 120W or CST 267 but not both.

Prerequisite(s): CSI 110W and CST 133W, both with a grade of “C” or better.
Corequisite(s): None
Lecture Hours: 45 Lab Hours: 0
Meets MTA Requirement: None
Pass/NoCredit: Yes

Outcomes and Objectives

Demonstrate the proper use of forensic software.
1. Use data carving.
2. Create forensic images.
3. Analyze forensic images.
Perform the steps in a digital investigation.
1. Demonstrate evidence gathering,
2. Demonstrate preservation of digital information.
3. Analyze information from a digital investigation.
4. Describe the role of digital investigation from obtaining evidence through the completion of legal proceedings.
Write professional quality reports.
1. Discuss in the report technical procedures used in the investigation.
2. Provide a summary report.
3. Produce a notes section.
Identify major file system components.
Demonstrate the ability to recover deleted files.
Identify important file metadata and their use in a forensic investigation.
Identify components of the Windows Registry, as well as the hives comprising it.
Perform a forensic investigation on a forensic image.
1. Use various tools to recover evidence.
2. Produce a report documenting the investigation.