Course: ECU 502 Investigating Network Intrusions and Computer Forensics
Purpose of Class:
This class is designed to equip students with necessary skills required to identify computer crime; gather and preserve digital evidence by following set of standards and procedures that hold good in the court of law; assist the attorney in legal proceedings to prosecute criminals involved in cases where one/many computers were used as part of the crime.
Course Learning Outcomes:
Students who successfully complete this class will be able to:
- Describe computer crime and computer investigation process and develop skills associated to the professional activity helpful in the field of computer forensics and Incident handling
- Acquire, extract, and analyze all the relevant digital evidence from computing devices using the most appropriate industry-accepted procedures and techniques to investigate computer crime.
- Consider different perspectives of data acquisition and duplication and develop an organizational strategy on investigating and monitoring the logs that holds good in the court of law.
- Understand the structure of file system and hard disk and recover hidden/deleted files or partitions.
- Understand various attacks and Internet crimes and use set of procedures accepted by court of law to investigate Internet crimes.
- Compare and contrast different forensic tools used in Forensics Investigations.
- Identify the ethical and legal implications used in the gathering, preserving, documenting, and dispatching of forensic evidence that holds good in the court of law
Required Reading:
- Computer Forensics: Investigating Wireless Networks and Devices, 1st Edition, EC-Council, ISBN: 9781435483538, © 2010 Published
- Computer Forensics: Investigating Network Intrusions and Cyber Crime, 1st Edition, EC-Council, ISBN: 9781435483521, © 2010 Published
- Computer Forensics: Investigating Data and Image Files, 1st Edition, EC-Council, ISBN: 9781435483514, © 2010 Published
- Computer Forensics: Hard Disk and Operating Systems, 1st Edition, EC-Council, ISBN: 9781435483507, © 2010 Published
- Computer Forensics: Investigation Procedures and Response, 1st Edition, EC-Council, ISBN: 9781435483491, © 2010 Published
Week One:
Modules Covered:
- Module 01: Computer Forensics in Today’s World
- Module 02: Computer Investigation Process
- Module 03: First Responder Procedures
- Module 04: Incident Handling
- Module 05: Computer Forensics Lab
- Module 06: Understanding File Systems and Hard Disks
Outcomes:
- Describe computer crime and computer investigation process and develop skills associated to the professional activity helpful in the field of computer forensics and Incident handling
- Acquire, extract, and analyze all the relevant digital evidence from computing devices using the most appropriate industry-accepted procedures and techniques to investigate computer crime.
- Compare and contrast different forensic tools used in Forensics Investigations
Week Two:
Modules Covered:
- Module 07: Digital Media Devices
- Module 08: Windows, Linux and Macintosh Boot Processes
- Module 09: Windows Forensics
- Module 10: Linux Forensics
- Module 11: Data Acquisition and Duplication
- Module 12: Computer Forensic Tools
Outcomes:
- Describe computer crime and computer investigation process and develop skills associated to the professional activity helpful in the field of computer forensics and Incident handling.
- Acquire, extract, and analyze all the relevant digital evidence from computing devices using the most appropriate industry-accepted procedures and techniques to investigate computer crime
- Consider different perspectives of data acquisition and duplication and develop an organizational strategy on investigating and monitoring the logs that holds good in the court of law.
- Understand the structure of file system and hard disk and recover hidden/deleted files or partitions.
Week Three:
Modules Covered:
- Module 13: Forensics Investigations Using Encase
- Module 14: Recovering Deleted Files and Partitions
- Module 15: Image Files Forensics
- Module 16: Steganography
- Module 17: Application Password Crackers
- Module 18: Network Forensics and Investigating Logs
Outcomes:
- Describe computer crime and computer investigation process and develop skills associated to the professional activity helpful in the field of computer forensics and Incident handling
- Compare and contrast different forensic tools used in Forensics Investigations
Week Four:
Modules Covered:
- Module 19: Investigating Network Traffic
- Module 20: Investigating Wireless Attacks
- Module 21: Investigating Web Attacks
- Module 22: Router Forensics
- Module 23: Investigating Denial of Service Attacks
- Module 24: Investigating Internet Crime
Outcomes:
- Describe computer crime and computer investigation process and develop skills associated to the professional activity helpful in the field of computer forensics and Incident handling.
- Acquire, extract, and analyze all the relevant digital evidence from computing devices using the most appropriate industry-accepted procedures and techniques to investigate computer crime.
- Consider different perspectives of data acquisition and duplication and develop an organizational strategy on investigating and monitoring the logs that holds good in the court of law
- Understand various attacks and Internet crimes and use set of procedures accepted by court of law to investigate Internet crimes
- Compare and contrast different forensic tools used in Forensics Investigations.
Week Five:
Modules Covered:
- Module 25: Tracking E-mails and Investigating E-mail Crimes
- Module 26: Investigating Corporate Espionage
- Module 27: Investigating Trademark and copyright infringement
- Module 28: Investigating Sexually Harassment Incidents
- Module 29: Investigating Child Pornography Cases, PDA Forensics
Outcomes:
- Describe computer crime and computer investigation process and develop skills associated to the professional activity helpful in the field of computer forensics and Incident handling
- Acquire, extract, and analyze all the relevant digital evidence from computing devices using the most appropriate industry-accepted procedures and techniques to investigate computer crime.
- Compare and contrast different forensic tools used in Forensics Investigations.
- Identify the ethical and legal implications used in the gathering, preserving, documenting, and dispatching of forensic evidence that holds good in the court of law.
Week Six:
Modules Covered:
- Module 30: I-pod and I-Phone Forensics
- Module 31: Blackberry Forensics
- Module 32: Investigative Reports
- Module 33: Becoming an Expert Witness
- Module 34: Law and Computer Forensics
Outcomes:
- Describe computer crime and computer investigation process and develop skills associated to the professional activity helpful in the field of computer forensics and Incident handling
- Acquire, extract, and analyze all the relevant digital evidence from computing devices using the most appropriate industry-accepted procedures and techniques to investigate computer crime.
- Identify the ethical and legal implications used in the gathering, preserving, documenting, and dispatching of forensic evidence that holds good in the court of law.
Weeks Seven and Eight: Summative Experiences
Introduction to Weeks: Weeks seven and eight are designed to provide cumulative experience while faculty and students are given the opportunity to finalize uncompleted work. For this course, students will engage in two summative assessments, a project and final examination.