Investigation techniques for recovering and analyzing digital evidence.
About this course
Digital Forensics moves beyond basic system administration to explore how investigators recover and analyze digital evidence. You will learn the standards for handling data so it holds up in legal proceedings, covering everything from imaging storage media to examining cloud artifacts and mobile devices.
Using industry-standard forensic tools, you will practice building a chain of custody, carving files from disk images, and reconstructing user activity. The course emphasizes documentation, so you can translate technical findings into clear reports for non-technical audiences.
Who takes this course
This is an elective open to students in the Cybersecurity program. It is also available to Computing & Information Technology students who have completed their scripting and cloud fundamentals.
Prerequisites
You must have completed CYBR 2930 Scripting Languages and CYBR 2710 Cloud Computing Basics before enrolling.
Assessment concerns
If you have a concern about your grade, raise it with your instructor within ten business days of the grade being posted. The Registrar's Office handles initial concerns and deadline extensions. Email [email protected] for more information.
Credits: 3 · Hours: 45
Prerequisites
Learning outcomes
- Apply legal and ethical standards to digital evidence collection and chain of custody procedures.
- Use forensic imaging tools to create bit-for-bit copies of storage media.
- Analyze file systems and recover deleted or hidden data from disk images.
- Examine cloud storage artifacts and mobile device logs for investigative leads.
- Document findings in clear reports suitable for legal proceedings.
Evaluation
| Component | Weight (%) |
| Practical lab assessments | 40 |
| Mid-term case study | 20 |
| Final forensic report and presentation | 40 |