CISF210 Computer Forensics II

Department of Science, Technology, Engineering & Mathematics: Computer/Information Science

I. Course Number and Title
CISF210 Computer Forensics II
II. Number of Credits
3 credits
III. Minimum Number of Instructional Minutes Per Semester
2250 minutes
IV. Prerequisites
CISF110 (C or better)
Corequisites
None
V. Other Pertinent Information
VI. Catalog Course Description
This course is a continuation of Computer Forensics I. Topics include the fundamentals of digital computer acquisition, preservation, and analysis. Classroom concepts will be applied in a laboratory setting where students will employ basic rules of evidence, standard operating procedures for computer forensics.
VII. Required Course Content and Direction
  1. Learning Goals:

    Course specific -The students will be able to:

    1. describe the features and differences between NTFS and FAT file systems;
    2. effectively utilize a commercial software tool to recover deleted files from a computer;
    3. evaluate the strengths and weaknesses of various software tools for data recovery; and
    4. develop a systematic approach to a computer investigation.
  2. Planned Sequence of Topics and/or Learning Activities:

    1. Investigative techniques
      1. The Investigator's Office and Laboratory
      2. Processing Crime and Incident Scenes
      3. Digital Evidence Controls
    2. Computer forensics tools
      1. hardware
      2. software
        1. command line
        2. GUI
    3. Platforms
      1. File systems
      2. Boot process
      3. Deleted files and slack space
      4. Network Forensics and E-Mail Investigations

  3. Assessment Methods for Core Learning Goals:

    This course is not in the Core.

    All Discipline-Specific Course Objectives will be assessed as follows:

    The student will apply computer forensic concepts and principles to solve problems presented through informal assessment, such as oral communication among students and between teacher and students. Formal assessment will consist of open-ended questions reflecting theoretical and applied situations, as well as laboratory exercises.

  4. Reference, Resource, or Learning Materials to be used by Students:

    Departmentally selected textbook and/or readings. Details provided by instructor of each course section. See course format.
VIII. Teaching Methods Employed
Use of lecture and hands-on demonstrations will be augmented at individual teacher's discretion.

Review/Approval Date - 5/07