Data Recovery, 7.5 credits
Datautvinning från digitala lagringsmedia, 7,5 hp
Course code: DI4003
School of Information Technology
Level: First cycle
Select course syllabus
Finalized by: Forsknings- och utbildningsnämnden, 2024-09-18 and is valid for students admitted for spring semester 2025.
Main field of study with advanced study
Digital Forensics, First cycle, has less than 60 credits in first-cycle course/s as entry requirements. (G1F)Entry requirements
The courses Linux Administration 7.5 credits and Programming 7.5 credits or the courses Introduction to Data Science 15 credits and Programmering för data science 7.5 credits. English 6. Exemption of the requirement in Swedish is granted.
Placement in the Academic System
The course is part of the programme IT-Forensics and Information Security 180 credits. The course is also offered as a freestanding course.
Objectives
In the course, the student will develop knowledge about methods and forensic tools to secure and extract data from digital storage media.
Following successful completion of the course the student should be able to:
Knowledge and understanding
- explain key concepts and models
- describe forensic correct methods to conserve evidence
Skills and ability
- analyze a given system for data extraction
- planning and implementing data extraction based on a system analysis
Judgement and approach
- relate to the correlation between actual outcome and conclusion based on an image.
Content
The course covers a theoretical introduction to data extraction from digital storage media which includes:
- the hardware solutions available on the market, in the field
- the most common data formats
- the tools available on the market for data extraction
- data recovery from physical devices such as hard disks or flash memories
- data recovery from logical devices such as email systems or databases
- monitoring and log analysis
- to hide data
- to encrypt data
- to prevent changes to data
Practical exercises in computer extraction.
Language of Instruction
Teaching Formats
Teaching consists of lectures and laboratory work.
Grading scale
Examination formats
The examination consists of a written exam and written laboratory reports.
1602: Written Examination, 4.5 credits
Four-grade scale, digits (TH): Fail (U), Pass (3), Pass with credit (4), Pass with distinction (5)
1601: Laborations, 3 credits
Two-grade scale (UG): Fail (U), Pass (G)
Exceptions from the specified examination format
If there are special reasons, the examiner may make exceptions from the specified examination format and allow a student to be examined in another way. Special reasons can e.g. be study support for students with disabilities.
Course evaluation
Course evaluation is part of the course. This evaluation offers guidance in the future development and planning of the course. Course evaluation is documented and made available to the students.
Course literature and other materials
Literature list 2025-01-20 – Until further notice
Nelson, Bill et al. Guide to Computer Forensics and Investigations, Cengage Learning, 5th edition.
Nikkel, Bruce. Practical Forensic Imaging, No Starch Press, 1st edition.
