Handbook

 Aim To provide students with a sound knowledge and understanding to enable them to recover admissible evidence from PC based computers and the skills and competencies to prepare such evidence for presentation in a Court of Law and to develop knowledge and understanding of advanced forensic computing techniques and to … For more content click the Read More button below.      Objectives On completion of this course, students should be able to: Understand the start-up procedures of operating systems, particularly in DOS and Windows environments, how they interact with the hard disk and the significance of the paging of memory to disk in a forensic environment.Demonstrate forensically sound techniques for recovering OS related digital artefacts from Windows-based and Unix-based file systems;Demonstrate forensically sound techniques for recovering digital artefacts associated with internet activity;Identify and recover evidence from a Windows registryArticulate the evidentiary value of recovered digital artefacts;Describe the “cause and effect” parameters of digital artefactsDescribe factors which limit the conclusions that can be drawn from digital artefacts; andApply the principles and procedures of computer forensics and tool validation.Used Windows and Unix based forensic computing tools      Course content   This course will introduce students to advanced technical issues related to electronic evidence collection examinations. There will be a strong emphasis on the technical aspects and details of forensic computing examinations. Topics will include advanced media structure and file system issues, recovery and analysis of Internet-related artefacts, and contextual analysis of digital data.