OVERVIEW

This course introduces students to applying forensic science principles and practices for collecting, examining, analyzing and presenting digital evidence. The course includes selected topics from digital forensics and information technology domains. It utilizes lectures, assignments and programming projects to illustrate these topics. We will explore these topics through the use of various open-source and commercial forensic tools.

AIMS AND CONTENT

LEARNING OUTCOMES

Learning how to conduct digital investigations, following the standard process involving identification, acquisition, storage, and analysis of digital evidence.

AIMS AND LEARNING OUTCOMES

At the end of the course, students will be able to:

• Understand and describe how forensic science is applied to the cyber realm
• Identify and describe various sources of digital evidence
• Know how to acquire digital evidence from hard drives and mobile devices
• Understand file systems and artifacts
• Conduct forensic analysis of both disk images and mobile devices
• Identify and describe basic legal principles regarding digital forensics

PREREQUISITES

Some familiarity with both Windows and Linux.

TEACHING METHODS

Class lectures and project activities, which consist of some assignments.

SYLLABUS/CONTENT

• Digital Forensics Domains
• Digital Forensics and Digital Evidence definition
• ISO Standards
• Digital Forensics Process (Identification, Preservation, Handling, Collection, Acquisition, Preservation, Analysis)
• Chain of Custody
• Forensic Aquisition
• Write blocking
• Hashing
• Partitioning
• File Systems
• Windows Forensics
• Windows registry
• LNK/Jumplists/Shellbags
• USB Device Analysis
• Windows Events
• Network forensics
• Mobile Forensics: definition, challenges and guidelines

RECOMMENDED READING/BIBLIOGRAPHY

Support material and recommended bibliography will be available on AulaWeb.

TEACHERS AND EXAM BOARD

Exam Board

GIOVANNI LAGORIO (President)

MATTIA EPIFANI

ENRICO RUSSO (President Substitute)

LESSONS

LESSONS START

In agreement with the calendar approved by the Degree Program Board of Computer Science.

Class schedule

The timetable for this course is available here: Portale EasyAcademy

EXAMS

EXAM DESCRIPTION

Oral exam, where both theory and hands-on projects, assigned during the course, will be discussed.

ASSESSMENT METHODS

The oral examination aims to verify students' actual knowledge, concepts, and theoretical notions covered during the course and their ability to apply these notions to specific contexts.
Moreover, the ability to critically re-elaborate the acquired knowledge, the correct application of the models discussed during the course and the formulation of personal reflections, if any, adequately reasoned and motivated, will be considered preferential.

Exam schedule