Module Details
The information contained in this module specification was correct at the time of publication but may be subject to change, either during the session because of unforeseen circumstances, or following review of the module at the end of the session. Queries about the module should be directed to the member of staff with responsibility for the module.
Title CYBER FORENSICS
Code CKIT519
Coordinator Mr K Dures
Computer Science
K.Dures@liverpool.ac.uk
Year CATS Level Semester CATS Value
Session 2021-22 Level 7 FHEQ Whole Session 15

Aims

To provide students with opportunities to learn how to identify, extract, document, interpret, preserve, assess, compare, and judge computer media for evidentiary purposes and/or root cause analysis.

Learning Outcomes

(LO1) A deep and critical understanding of the theory and practice of computer forensics.

(LO2) A complete understanding of the processes for digital evidence acquisition, authentication, analysis, and auditing.

(LO3) An understanding of the use of computer forensic tools to carry out digital forensic investigation.

(LO4) Be able to conduct digital forensic investigations with respect to a variety of computer platforms.

(LO5) An understanding of the legal framework within which the discipline of computer forensics operates (with respect to a number of different countries).

(LO6) In the context of computer forensics, be able to differentiate between ethical issues, legal issues, and criminal motives.

(LO7) An awareness of future trends in computer forensics.

(S1) Organisational skills

(S2) Communication skills

(S3) IT skills

(S4) Communication and collaboration online participating in digital networks for learning and research

(S5) Learning skills online studying and learning effectively in technology-rich environments, formal and informal

Syllabus
 

Week 1:  Digital Evidence, Computer Crime, Technology, and Law Acquisition, authentication and analysis of digital evidence. Comparison of technology and legal framework for different countries.   Week 2:  The Investigative Process, Reconstruction, and Modus Operandi The digital evidence investigative process; investigative reconstruction; and modus operandi, motive, and technology.   Week 3:  Applying Forensic Science to Computers The role of digital evidence in court trials and the application of forensic science to computers.   Week 4:  Investigating Windows Computers and Network Forensics Forensic investigation technologies for computers running the Microsoft Windows™ Operating Systems.   Week 5:  Investigation Unix Systems, Macintosh Systems, and Handheld Devices Forensic investigation technologies for UNIX systems, Macintosh systems, and handheld devices.   Week 6:  Network Forensics I Network basics for digital inv estigations and network forensic techniques on physical and data-link layers.   Week 7:  Network Forensics II Comparison of network forensics at the network, transport, session, presentation and application layers.   Week 8:  Computer Crime Investigation and Career Development Guidelines for computer crime investigation, career development as a computer forensic investigator, and future trends of computer forensics.

Teaching and Learning Strategies

Teaching Method
Online Learning

Teaching Method 1 - Virtual classroom hours (for online modules)
Description:
Teaching Method 2 - Non-classroom hours (for online modules)

Description:
Weekly seminar supported by asynchronous discussion in a virtual classroom environment facilitated by an online instructor.

Attendance Recorded
Yes

Notes
Number of hours per week that students are expected to attend the virtual classroom so as to participate in discussion, dedicated to group work and individual assessment is 8.75.

Self-Directed Learning Description: Number of hours per week that students are expected to devote to reading, research and other individual work to support engagement in the classroom is 10.

Teaching Schedule
  Lectures Seminars Tutorials Lab Practicals Fieldwork Placement Other TOTAL
Study Hours           70

 70
Timetable (if known)              
Private Study 80
TOTAL HOURS 150

Assessment
EXAM Duration Timing
(Semester)		 % of
final
mark		 Resit/resubmission
opportunity		 Penalty for late
submission		 Notes
             
CONTINUOUS Duration Timing
(Semester)		 % of
final
mark		 Resit/resubmission
opportunity		 Penalty for late
submission		 Notes
Practical - Investigating a disk image Standard UoL penalty applies for late submission. This is not an anonymous assessment. Assessment Schedule (When) :Week 7  One week/ Analysis o    10       
Practical & Report - Creating a case on Linux Standard UoL penalty applies for late submission. This is not an anonymous assessment. Assessment Schedule (When) :Week 6  One week/ 750-1,000     10       
Essay - Investigating a case Standard UoL penalty applies for late submission. This is not an anonymous assessment. Assessment Schedule (When) :Week 5  One week/ 750-1,000     10       
Practical & Report - Creating a case Standard UoL penalty applies for late submission. This is not an anonymous assessment. Assessment Schedule (When) :Week 4  One week/750-1,000 w    10       
Practical & Report - Hard drive analysis Standard UoL penalty applies for late submission. This is not an anonymous assessment. Assessment Schedule (When) :Week 3  One week/750-1,000 w    10       
Essay - Constructing a forensic lab Standard UoL penalty applies for late submission. This is not an anonymous assessment. Assessment Schedule (When) :Week 2  One week/750-1,000 w    10       
Essay - Finding tools report Standard UoL penalty applies for late submission. This is not an anonymous assessment. Assessment Schedule (When) :Week 1  One week/ 750-1,000     10       

Recommended Texts
Reading lists are managed at readinglists.liverpool.ac.uk. Click here to access the reading lists for this module.