MODULE CONTENT
BRIEF DESCRIPTION
This module introduces the foundation of computer and mobile forensics. The students will learn about different tools and techniques in forensic computing starting from collecting the evidence, preserving the evidence towards analysing the evidence. A forensic/security investigator must seek evidence that has been hidden or obscured with digital storage devices such as personal computers or shared network drives. To complete this task efficiently the investigator must have the ability to locate and retrieve data from a number of sources, using a variety of tools and techniques. Preserve and protect the evidence is also vital in this process as it is discovered so that it may be accurately interpreted and reported.
SUMMARY OF THE LEARNING AND TEACHING ACTIVITIES
1 hour lecture followed by a 2 hour lab session. You are required to undertake at least 5 hours of independent study per week. Note that completing the set independent study tasks will develop your understanding and will more likely result in a much higher overall mark at the end of the module.
All students are entitled to both formative and summative feedback during the module. Formative feedback is designed to enable you to improve your work/performance and takes many forms. Students will have several opportunities to receive feedback on their progress, e.g. during lab sessions, tutorials or seminars; as part of general feedback in lectures; and where appropriate, one to one sessions with their Academic Review Tutors. Summative feedback is received when your submitted coursework has been marked. As a minimum this will comprise constructive comments from the tutor and a final grade.
MODULE AIM
This module seeks to develop a student's understanding and knowledge of computer forensic tools and techniques.
LEARNING OUTCOMES
By the end of the module, students should be able to:
1. Understand ACPO process.
2. Understand the tools and techniques used within Forensic Computing.
3. Identify the locations of forensically significant data and the means to recover it.
4. Use appropriate tools to display stored data.
5. Present, evaluate and interpret forensically significant data.