Advanced IT-Forensic Tools, 7.5 credits
Avancerade IT-forensiska verktyg, 7,5 hp
Course code: DI4009
School of Information Technology
Level: First cycle
Select course syllabus
Finalized by: Forsknings- och utbildningsnämnden, 2024-11-18 and is valid for students admitted for spring semester 2025.
Main field of study with advanced study
Digital Forensics, First cycle, has less than 60 credits in first-cycle course/s as entry requirements. (G1F)Entry requirements
Data Recovery 7,5 credits. English 6. Exemption of the requirement in Swedish is granted.
Placement in the Academic System
The course is part of the programme IT- Forensics and Information Security 180 credits. The course is also offered as a freestanding course.
Objectives
In the course the student gets the possibility to achieve practical skills in performance of IT forensic analysis using various forensic tools.
Upon completion of the course the student shall be able to:
Knowledge and understanding
- Identify and extract data of different characteristics
- Account for how data is connected at different levels
Skills and ability
- Apply known methods for data analysis on unknown cases
- Plan and perform an IT-forensic investigation
- Compile and present analysis results in an understandable fashion for a person with no technical expertise
- Criticize and identify weakness in existing reports and methodological descriptions
Judgement and approach
- Show awareness of the ethical and legal aspects of the investigation
Content
Planning and implementation of IT forensic investigations.
Analysis and review of expert reports and technical reports. Report writing for an audience without technical expertise.
Language of Instruction
Teaching Formats
The teaching consists of lectures, seminars and labs.
Grading scale
Examination formats
A written exam, practical test and seminar and seminar report.
1801: Written Examination, 3.5 credits
Four-grade scale, digits (TH): Fail (U), Pass (3), Pass with credit (4), Pass with distinction (5)
1802: Practical Exam, 2 credits
Two-grade scale (UG): Fail (U), Pass (G)
2001: Seminar and Written Seminar Report, 2 credits
Two-grade scale (UG): Fail (U), Pass (G)
Exceptions from the specified examination format
If there are special reasons, the examiner may make exceptions from the specified examination format and allow a student to be examined in another way. Special reasons can e.g. be study support for students with disabilities.
Course evaluation
Course evaluation is part of the course. This evaluation offers guidance in the future development and planning of the course. Course evaluation is documented and made available to the students.
Course literature and other materials
Literature list 2025-01-20 – Until further notice
Nelson, Bill et al. Guide to Computer Forensics and Investigations, Cengage Learning, 5th edition.
Nikkel, Bruce. Practical Forensic Imaging, No Starch Press, 1st edition.
Additional litterature and scientific articles might be added.
