Handbook

The aim of this course is to enable students to develop knowledge, understanding and skills for the recovery of admissible evidence from computers and devices which are connected to a network or which have been used to exchange data across the Internet. On completion of this course, students should be … For more content click the Read More button below. Appraise the advantages and disadvantages of shutting a network down in order to examine it for evidenceDescribe the topology of a specific network and demonstrate an understanding of how the network is seen by any particular userUnderstand and demonstrate, practically, methods by which files can be attributed to a user and identify who actually had access to themDemonstrate knowledge and understanding of the file ownership, access and storage systems used in common networksFormulate a strategy for the recovery of evidence from any specific networkuse and evaluate different methods of data preservation from devices, including removal and download of data from silicon chips, software synchronization and forensic software.Students will also be able to develop methods of interpreting data copied from these devicesIdentify the more common areas containing information about Internet transactions on a hard disk and apply this knowledge to recover data from themDemonstrate knowledge and understanding of the procedures which have taken place electronically in the transmission and reception of E-mail and attachments and other transactionsRecovery and analysis of Internet-related artefacts, and contextual analysis of digital data.