Handbook

This course will introduce participants to digital forensic analysis and investigation first principles. Students will be introduced to theoretical concepts including the digital forensic method, intent and its application. The course will also cover introductory Microsoft Windows centric technical topics such as file system, memory and operating system artefact analysis using contemporary open source tools, techniques and procedures. Students will be expected to demonstrate both their theoretical and technical understanding through the completion of practical exercises in a contemporary simulated operational environment.

This is an introductory course covering:

• Forensic analysis theory
• Disk forensic theory and practical exercises targeting common Windows centric filesystems
• Configuration forensic theory and practical exercises targeting the Microsoft Windows Registry
• Network forensic theory and practical exercises
• Memory forensic theory and practical exercises targeting the Microsoft Windows operating platform

Digital Forensics comprises five separate modules of intensive theory and practical sessions delivered remotely in conjunction with the UNSW ADFA campus. Theory, taught during lectures, is reinforced with practical hands-on laboratories.

The intended audience for this course are students that have no previous experience or exposure to the field of digital forensics. As a result, students should expect the course material to be introductory and all inclusive, with no digital forensic pre-reading required. However, students are expected to be comfortable working in a Linux command line environment and must have some experience with the Python programming language.