Module Details
The information contained in this module specification was correct at the time of publication but may be subject to change, either during the session because of unforeseen circumstances, or following review of the module at the end of the session. Queries about the module should be directed to the member of staff with responsibility for the module.
Title CYBER FORENSICS
Code CKIT519
Coordinator Mr K Dures
Computer Science
K.Dures@liverpool.ac.uk
Year CATS Level Semester CATS Value
Session 2018-19 Level 7 FHEQ Whole Session 15

Aims
·       To provide students with a comprehensive understanding of the domain of computer forensics.
·       To instruct students in the tools and techniques that will allow them to identify and extract evidence from computer media.
·       To equip students with an in depth knowledge of the processes whereby material extracted from computer media can be assessed and judged for evidentiary purposes.
·       To provide students with a complete understanding of the process of documenting computer forensic evidence.

Learning Outcomes

A deep and critical understanding of the theory and practice of computer forensics.

A complete understanding of the processes for digital evidence acquisition, authentication, analysis, and auditing.

A systematic understanding of the use of computer forensic tools to carry out digital forensic investigations.

An ability to conduct digital forensic investigations with respect to a variety of computer platforms.

A critical comprehension of the legal framework within which the discipline of computer forensics operates (with respect to a number of different countries).

In the context of computer forensics, be able to differentiate between ethical issues, legal issues, and criminal motives.
A critical awareness of future trends in computer forensics.

Syllabus
1 
Week 1:  Digital Evidence, Computer Crime, Technology, and Law
Acquisition, authentication and analysis of digital evidence. Comparison of the technology and legal framework for different countries.
 
Week 2:  The Investigative Process, Recons truction, and Modus Operandi
The digital evidence investigative process; investigative reconstruction; and "modus operandi", motive, and technology.
 
Week 3:  Applying Forensic Science to Computers
The role of digital evidence in court trials and the application of forensic science to computers.
 
Week 4:  Investigating Windows Computers and Network Forensics
Forensic investigation technologies for computers running the Microsoft Windows™ Operating Systems.
 
Week 5:  Inves tigation Unix Systems, Macintosh Systems, and Handheld Devices
Forensic investigation technologies for UNIX systems, Macintosh systems, and handheld devices.
 
Week 6:  Network Forensics I
Network basics for digital investigations and network forensic techniques on physical and data-link layers.
 
Week 7:  Network Forensics II
Comparison of network forensics at the network, transport, session, presentation and application layers.
 
Week 8:  Computer Crime Investigation and Career Dev elopment
Guidelines for computer crime investigation, career development as a computer forensic investigator, and future trends of computer forensics.

Teaching and Learning Strategies

Online Learning - Weekly seminar supported by asynchronous discussion in a virtual classroom environment facilitated by an online instructor.

Number of hours per week that students are expected to attend the virtual classroom so as to participate in discussion, dedicated to group work and individual assessment is 8.75.

Teaching Schedule
  Lectures Seminars Tutorials Lab Practicals Fieldwork Placement Other TOTAL
Study Hours           70
Weekly seminar supported by asynchronous discussion in a virtual classroom environment facilitated by an online instructor.
70
Timetable (if known)           Number of hours per week that students are expected to attend the virtual classroom so as to participate in discussion, dedicated to group work and individual assessment is 8.75.
  		 
Private Study 80
TOTAL HOURS 150

Assessment
EXAM Duration Timing
(Semester)		 % of
final
mark		 Resit/resubmission
opportunity		 Penalty for late
submission		 Notes
             
CONTINUOUS Duration Timing
(Semester)		 % of
final
mark		 Resit/resubmission
opportunity		 Penalty for late
submission		 Notes
Coursework  Weekly Discussion Qu  Whole Session  40  No reassessment opportunity  Standard UoL penalty applies  8 moot/debate discussion questions There is no reassessment opportunity, The nature of the adopted online learning paradigm is such that no reassessment opportunity is available; instead students failing the module will be offered the opportunity to retake the entire module. 
Coursework  One week  Week 2  10  No reassessment opportunity  Standard UoL penalty applies  Practical Assignment: Forensics using MS Windows There is no reassessment opportunity, The nature of the adopted online learning paradigm is such that no reassessment opportunity is available; instead students failing the module will be offered the opportunity to retake the entire module. 
Coursework  Two week  Week 4  10  No reassessment opportunity  Standard UoL penalty applies  Practical Assignment: Data Leakage Analysis (Windows) There is no reassessment opportunity, The nature of the adopted online learning paradigm is such that no reassessment opportunity is available; instead students failing the module will be offered the opportunity to retake the entire module. 
Coursework  One week  Week 5  10  No reassessment opportunity  Standard UoL penalty applies  Programming: Forensic Tools There is no reassessment opportunity, The nature of the adopted online learning paradigm is such that no reassessment opportunity is available; instead students failing the module will be offered the opportunity to retake the entire module. 
Coursework  One week  Week 6  10  No reassessment opportunity  Standard UoL penalty applies  Practical Assignment: Windows RAM analysis There is no reassessment opportunity, The nature of the adopted online learning paradigm is such that no reassessment opportunity is available; instead students failing the module will be offered the opportunity to retake the entire module. 
Coursework  One week  Week 7  10  No reassessment opportunity  Standard UoL penalty applies  Practical Assignment: MacOS Hard Drive Analysis There is no reassessment opportunity, The nature of the adopted online learning paradigm is such that no reassessment opportunity is available; instead students failing the module will be offered the opportunity to retake the entire module. 
Coursework  One week  Week 8  10  No reassessment opportunity  Standard UoL penalty applies  Practical Assignment: Data Leakage Analysis (Linux) There is no reassessment opportunity, The nature of the adopted online learning paradigm is such that no reassessment opportunity is available; instead students failing the module will be offered the opportunity to retake the entire module. Notes (applying to all assessments) 1) Due to nature of the online mode of instruction this work is not marked anonymously. 2) Students who fail the module have the opportunity to repeat the entire module. 3) The "Standard UoL Penalty" for late submission that applies is the "Standard UoL Penalty" agreed with respect to online programmes offered in collaboration with Laureate Online Education. 4) For group work assessments groups typically comprise 3 to 4 students. Both group and individual contributions are assessed and integrated to produce a final mark for each student. 

Recommended Texts
Reading lists are managed at readinglists.liverpool.ac.uk. Click here to access the reading lists for this module.
Explanation of Reading List:

The online programmes offered by the department of Computer Science in Collaboration with Laureate Online Education use online materials wherever possible including the online resources available within the University of Liverpool’s libraries. This module does not require a specific text book.