Handbook

The subject of Digital Forensics is a blend of technical expertise, legal procedures for an expert witness, persuasive report writing and your performance in the theatre of court. This course covers both forensic theory / professional practice, and looks at the underlying engineering of hiding, finding, interpreting and responding to traces. Students will use standard forensic tools to extract, carve and analyse data as well as learning the low-level technical skills and knowledge underlying them. Students will also be introduced to advanced topics such as Cloud Forensics and latest anti-forensics techniques.

COMP6445 and COMP6845 run in an overlapping mode. Both share a set of common activities and assessments; however COMP6845 students have additional extension activities and assessments related to digital forensics. These activities offer more advanced and in-depth study of the topic. COMP6445 students are welcome to attend the extended lectures. The information below applies to both courses except where otherwise indicated. 

By the end of the course students should be able to write and analyse simple forensic tools as well as being able to use them. The course covers Memory Forensics, Disc Forensics Network, Device Forensics, Stealth Techniques, Anti-forensics, Professional Forensic Practice, (chain of custody, records etc), Logging, and Mobile Forensics.

Students of this course will apply forensic methods in controlled environments and gain an understanding of the technical process of uncovering hidden data and other metadata which may reveal user behaviour. Students will also develop skills in reporting their findings and evaluate the ethical consequences of their findings. Digital Forensics students are invited to participate in a mock courtroom experience involving testimony and cross-examination of digital forensics expert witnesses. We plan to run a mock civil trial of company vs rogue employee with a presiding Judge, and lecturers acting as advocates and students as expert witnesses.