Handbook

The subject of Digital Forensics is a blend of technical expertise, legal procedures for an expert witness, persuasive report writing and your performance in the theatre of court. This course covers both forensic theory / professional practice, and looking at the underlying engineering of hiding, finding, interpreting and responding to traces. Students will use of standard forensic tools to extract, carve and analyse data as well as learning the low-level technical skills and knowledge underlying them. Students will also be introduced to advanced topics such as Cloud Forensics and latest anti-forensics techniques.

COMP3445/COMP6445 and COMP6845 run in an overlapping mode. All share a set of common activities and assessments; however COMP6845 students have additional extension activities and assessments related to digital forensics. These activities offer more advanced and in-depth study of the topic. The main differences between COMP3445/COMP6445 and COMP6845 derive from the motivations behind them, unlike other SECedu courses, the extended course (COMP6845) is not only exclusively a more technical deep dive into core (COMP3445/COMP6445) concepts but also exposes students to advanced topics in Digital Forensics such as Splunk Logging, iOS and Android Forensics. Hence, COMP6845 includes a deeper dive into more technical aspects of digital forensics. This is achieved through additional weekly workshop/lecture during the term.

By the end of the course students should be able to write and analyse simple forensic tools as well as being able to use them. The course covers Memory Forensics, Disc Forensics Network, Device Forensics, Stealth Techniques, Anti-forensics, Professional Forensic Practice, (chain of custody, records etc), Logging, and Mobile Forensics. Students of this course will apply forensic methods in controlled environments and gain an understanding of the technical process of uncovering hidden data and other metadata which may reveal user behaviour. Students will also develop skills in reporting their findings and evaluate the ethical consequences of their findings. Digital Forensics students are invited to participate in a mock courtroom experience involving testimony and cross-examination of digital forensics expert witnesses. We plan to run a mock civil trial of company vs rogue employee with a presiding Judge, and lecturers acting as advocates and students as expert witnesses.