Arash Habibi Lashkari
Assistant Professor

DIGITAL FORENSICS

In this course, students will learn the principles and techniques for digital forensics investigation and the spectrum of available forensics tools. They will learn about core forensic procedures to ensure court admissibility of evidence, as well as the legal and ethical implications. They will see how to perform a forensic investigation on both Unix/Linux and Windows operating systems with different file systems and be guided through forensic procedures and review and analyze forensics reports. The main objective of this course is to provide a practical study of digital forensics principles and techniques with emphasis on the forensics procedures and tools on both Unix and Windows systems from different aspects such as network, memory, image, and logs along with reviewing and analyzing the forensics reports.

ORGANISATION

Language: The class is taught in English.
Assistant: Select one student to manage, handle and collect the assignments, projects, and Lab activities.
MidTerm Examination: Written examination, (10%)
Final Examination: Written examination, (50%)
Courseworks: First coursework is compulsory + select one from number 2 or 3, (40%)
Coursework 1: 5 Courseworks (individual) (15% = 5 + 3%)
Coursework 2: A project by JAVA or Python (Group based) + Presentation, (25%=20% + 5%)

LECTURE NOTES

• Session 1: Introduction An overview of digital forensics and the anatomy of digital investigation.
• Coursework 1
• Session 2: How to Prepare Preparing for digital investigation by taking a systematic approach.
• Session 3: Windows file system and forensics analysis Focusing on building in-depth digital forensics knowledge of Windows operating systems from Acquisition to analysis.
• Coursework 2
• Session 4: Linux file system and forensics analysisFocusing on building in-depth digital forensics knowledge of Linux operating systems from Acquisition to analysis.
• Coursework 3
• Session 5: Wired and wireless network forensics Discussing about discovering and retrieving evidential information in a networked environment (Wired and Wireless) along with related forensics tools.
• Session 6: Memory forensics Focusing on the memory capturing, and sorts and numerical analyzes the information on systems to collect volatile components of evidence in real time along with related forensics tools.
• Coursework 4
• Session 7: File Forensics Presenting how can collect, handle, store and analyze the log data to support a forensic investigation along with related forensics tools.
• Session 8: Internet Forensics Study of source and content of e-mail and web as evidence to identify the actual sender and the recipient of a message, data/time of transmission, detailed record of e-mail transaction, intent of the sender along with content of web sites and servers with related obfuscation techniques.
• Coursework 5
• Session 9: Mobile Forensics Focusing on the concepts of mobile forensics, the core values, and challenges involved along with understanding Android App Analysis, Malware and Reverse Engineering, Android forensic setup and Pre-Data Extraction Techniques.
• Session 10: Cloud Forensics Discussing about the Forensic data collection in a cloud environment, and Elastic, static, and live forensics along with evidence segregation and investigations in virtualized environments.
• Session 11: Anti- Forensics and Anti-Anti-Forensics
• Final Project

HANDOUT FOR LAB SESSIONS

• Handout 1: Network Forensics: Acquisition
• Handout 2: Network Forensics: Acquisition and Analysis
• Handout 3: Memory Forensics : Acquisition and Analysis
• Handout 4: Memory Forensics: Analysis
• Handout 5: File Forensics: Acquisition and Analysis
• Handout 6: Image Forensics: Analysis
• Handout 7: Internet Forensics: Email Forensics