CS 593 Digital Forensics

Credit Hours:	3
Course Coordinator:	Warren Harrison
Course Description:	Detailed, hands-on approach to the investigation of criminal incidents in which computers or computer technology play a significant or interesting role. Familiarization with the core computer science theory and practical skills necessary to perform rudimentary computer forensic investigations, understanding the role of technology in investigating computer-based crime, and preparation to deal with investigative bodies.
Prerequisites:	Recommended: CS 333 or 533. No prior background in criminal justice or law is assumed.
Goals:	To introduce students to computer forensics; especially the technical and legal issues and limitations. . Upon the successful completion of this course students will be able to: Identify relevant electronic evidence (both inculpatory and exculpatory) associated with various violations of specific laws, including, but not limited to, computer crimes. Locate and recover relevant electronic evidence from Linux and Windows systems using a variety of tools. Identify and articulate probable cause as necessary to obtain a warrant to search for electronic artifacts, and recognize the limits of warrants Recognize and maintain a chain of custody of electronic evidence. Follow a documented forensics investigation process.
Textbooks:	None. Class handouts and web resources are used
References:	Web resources
Major Topics:	The judicial system and the role of evidence Search and Seizure, especially with regard to Constitutional limitations Electronic Communications Privacy Act (ECPA) Files systems: FAT and NTFS Forensics tools
Laboratory Exercises:	Students are presented with an evidence disk, and a crime. Within the context of the elements of the crime, students must locate relevant evidence on the drive.

CAC Category Credits	Core	Advanced
Data Structures		0.5
Algorithms		0.5
Software Design
Computer Architecture		0.5
Programming Languages

Oral and Written Communications:	Student teams formally present evidence they have gathered from another team’s hard drive to the class. Each team member is required to speak during the presentation.
Social and Ethical Issues:	Students learn all about the laws involving search & seizure
Theoretical Content:	None
Problem Analysis:	Students are presented with an evidence disk, and a crime. Within the context of the elements of the crime, students must locate relevant evidence on the drive.
Solution Design:	Students are presented with an evidence disk, and a crime. Within the context of the elements of the crime, students must locate relevant evidence on the drive.