Course Description
This unit introduces the key principles of digital forensics. Different fields of data forensics are introduced, the types of digital evidence that can be acquired are detailed, and learners are introduced to the key stages of digital forensic investigations. Learners will gain practical experience in performing forensic analyses of computer systems, as well identifying the source and integrity of multimedia, using digital forensics software and tools. Legal and ethical considerations relating to chain of custody, privacy-security trade-offs, and the impact of artificial intelligence are discussed.
Course Objectives
This unit introduces the key principles of digital forensics. Different fields of data forensics are introduced, the types of digital evidence that can be acquired are detailed, and learners are introduced to the key stages of digital forensic investigations. Learners will gain practical experience in performing forensic analyses of computer systems, as well identifying the source and integrity of multimedia, using digital forensics software and tools. Legal and ethical considerations relating to chain of custody, privacy-security trade-offs, and the impact of artificial intelligence are discussed.
Key Topics
- LO1: Understand the principles of digital forensics.
- LO2: Understand the key techniques used in digital forensic investigations.
- LO3: Be able to conduct forensic analysis of computer systems and storage media.
- LO4: Be able to use digital forensic techniques to verify the source and authenticity of image and video data.
- LO5: Understand the legal and ethical aspects of digital forensics.
Course Outline
| Week | Topics |
|---|
| 1 | From crime scene to digital crime scene: Locard's exchange principle, types of digital forensics (computer, mobile, network, database, cloud, memory) and their use in criminal and corporate investigations |
| 2 | Stages of forensic investigation (identification, preservation, analysis, documentation, presentation) and the chain of custody |
| 3 | Best practices: contemporaneous notes and the ACPO Good Practice Guide |
| 4 | Forensic techniques: cross-drive and live analysis, data carving, network traffic analysis, keyword searching, reverse steganography, stochastic forensics |
| 5 | Evidence acquisition: order of volatility, RAM and disk imaging, best practices for collection |
| 6 | Forensic tools lab: Autopsy, FTK or EnCase |
| 7 | Multimedia forensics: source detection and device identification |
| Midterm | Midterm evaluation |
| 9 | Digital watermarking: purposes, techniques and requirements, AI watermarking |
| 10 | Challenges and risks of multimedia investigations, including vicarious trauma |
| 11 | Legal and ethical concerns: admissibility, privacy and data protection, AI and copyright |
| 12 | Applying Digital Forensics in practice: case studies |
| 13 | Assignment workshop: research, planning and referencing |
| 14 | Assignment workshop: drafting, feedback and improvement |
| 15 | Review and coursework completion |
| Final | Final assessment and submission |
Learning Outcomes
- LO1 Understand the principles of digital forensics.
- 1.1 Describe the core concepts of digital forensics.
- 1.2 Explain the main stages of digital forensic investigations.
- 1.3 Explain the role of digital forensics in criminal and corporate investigations.
- 1.4 Critically analyse the importance of maintaining a chain of custody.
- LO2 Understand the key techniques used in digital forensic investigations.
- 2.1 Identify a range of best practices in digital forensics.
- 2.2 Explain the range of types of digital evidence.
- 2.3 Analyse the role of device fingerprints in matters of identity.
- 2.4 Evaluate the techniques most suitable to different forensic investigations.
- LO3 Be able to conduct forensic analysis of computer systems and storage media.
- 3.1 Describe best practices for collecting digital evidence.
- 3.2 Explain how the volatility of digital evidence impacts on evidence collection procedures.
- 3.3 Use forensic tools to forensically analyse digital data and recover hidden data.
- LO4 Be able to use digital forensic techniques to verify the source and authenticity of image and video data.
- 4.1 Use source analysis to identify the source of image and video data.
- 4.2 Use content analysis to verify the authenticity and integrity of media.
- 4.3 Explain how digital watermarking can be used to protect intellectual property and for security.
- 4.4 Critically analyse the challenges posed by generative artificial intelligence in verifying data authenticity.
- 4.5 Evaluate the challenges and risks associated with multimedia digital forensic investigations.
- LO5 Understand the legal and ethical aspects of digital forensics.
- 5.1 Explain the legal frameworks governing digital evidence and forensic investigations.
- 5.2 Explain the ethical considerations in conducting forensic investigations.
- 5.3 Evaluate the impact of anti-forensic techniques on evidence collection and analysis.
