Handbook

The aim of this course is to enable students to develop knowledge, understanding and skills for the recovery of admissible evidence from computers and devices which are connected to a network or which have been used to exchange data across the Internet.

On completion of this course, students should be able to:

• Appraise the advantages and disadvantages of shutting a network down in order to examine it for evidence
• Describe the topology of a specific network and demonstrate an understanding of how the network is seen by any particular user
• Understand and demonstrate, practically, methods by which files can be attributed to a user and identify who actually had access to them
• Demonstrate knowledge and understanding of the file ownership, access and storage systems used in common networks
• Formulate a strategy for the recovery of evidence from any specific network
• use and evaluate different methods of data preservation from devices, including removal and download of data from silicon chips, software synchronization and forensic software.Students will also be able to develop methods of interpreting data copied from these devices
• Identify the more common areas containing information about Internet transactions on a hard disk and apply this knowledge to recover data from them
• Demonstrate knowledge and understanding of the procedures which have taken place electronically in the transmission and reception of E-mail and attachments and other transactions
• Recovery and analysis of Internet-related artefacts, and contextual analysis of digital data.