CISF110 Computer Forensics I

Department of Science, Technology, Engineering & Mathematics: Computer/Information Science

I. Course Number and Title
CISF110 Computer Forensics I
II. Number of Credits
3 credits
III. Number of Instructional Minutes
IV. Prerequisites
CISC105 or CISC128
CISC128 with permission of the Department of Science, Technology, Engineering and Mathematics
V. Other Pertinent Information
VI. Catalog Course Description
This course is an introduction to the science of computer forensics. Topics include how data is stored, where it is located, and how to recover data, using commercial and open source software utilities to conduct computer investigations. Students gain hands-on experience in the laboratory.
VII. Required Course Content and Direction
  1. Course Learning Goals

    Students will:

    1. explain the computer forensics profession;
    2. diagram the structure of files on a hard disk;
    3. describe the features and operation of modern file systems;
    4. perform elementary forensic analysis and data recovery on the FAT (File Allocation Table) systems, using only a hex editor; and
    5. evaluate the strengths and weaknesses of various software tools for data recovery.
  2. Planned Sequence of Topics and/or Learning Activities

    Course Outline:

    1. Computer Forensics Profession
      1. Job Outlook
      2. Certification
    2. Investigative Techniques
    3. Computer Forensics Tools
      1. Hardware
      2. Software
        1. Command Line
        2. GUI
    4. Operating Systems
      1. Working with Windows and DOS Systems
      2. Macintosh and Linux Boot Processes and File System
  3. Assessment Methods for Course Learning Goals

    Formal assessment will consist of open-ended questions reflecting theoretical and applied situations, as well as laboratory exercises.
  4. Reference, Resource, or Learning Materials to be used by Student:

    Departmentally-selected textbook and/or readings. Details provided by instructor of each course section. See course syllabus.

Review/Approval Date - 5/07; Pre-req/co-req revised 02/2011; Dept name change 8/21/2012; New Core 8/2015