Module overview
We will study the tools and techniques used in digital forensics and its relevance to incident responses and criminal investigations. This will include: Network Traffic, Disk and Memory Forensics, Hardware Architectures, Forensics frameworks, Attributions.
Aims and Objectives
Learning Outcomes
Subject Specific Intellectual and Research Skills
Having successfully completed this module you will be able to:
- Develop new tools for Digital Forensics
- Analyse the internals of attacks and malware
Subject Specific Practical Skills
Having successfully completed this module you will be able to:
- Formulate a response to attack incidents
- Perform behavioural analysis on malware
Knowledge and Understanding
Having successfully completed this module, you will be able to demonstrate knowledge and understanding of:
- Digital Forensics methods and tools
- Hardware and OS Internals
Syllabus
•Introduction to Digital Forensics
•The investigation process
•Legal aspects in forensics
•Data and evidence collection
•Creating and analysing disk images
•Memory forensics
•Windows OS forensics
•Linux OS forensics
•Network forensics
•Digital investigation process models (general steps)
•Digital investigation process models (Examples of Models)
•Attacks’ Modus Operandi and Motivations (with a case study)
•Attribution of Attacks (with two case studies)
Learning and Teaching
Teaching and learning methods
Lectures and lab-based tutorials
| Type | Hours |
|---|---|
| Wider reading or practice | 24 |
| Lecture | 24 |
| Preparation for scheduled sessions | 10 |
| Completion of assessment task | 60 |
| Practical | 12 |
| Revision | 10 |
| Follow-up work | 10 |
| Total study time | 150 |
Assessment
Summative
This is how we’ll formally assess what you have learned in this module.
| Method | Percentage contribution |
|---|---|
| Coursework | 40% |
| Examination | 60% |
Referral
This is how we’ll assess you if you don’t meet the criteria to pass this module.
| Method | Percentage contribution |
|---|---|
| Examination | 100% |
Repeat
An internal repeat is where you take all of your modules again, including any you passed. An external repeat is where you only re-take the modules you failed.
| Method | Percentage contribution |
|---|---|
| Examination | 100% |
Repeat Information
Repeat type: Internal & External