Digital Forensic Science

Students will develop an understanding of the components of information systems and their relationships by acquiring knowledge on a variety of foundational information technology and security topics, including computing hardware, operating systems, and applications and their development. Different types of networks, topologies, and protocols are covered in an accelerated fashion to prepare students for successful completion of their desired program(s) and analysis of basic network communications.

In this course, students will acquire explicit legal knowledge, particular computer and other digital device skills, and good oral and written forensic reporting abilities needed for successful completion of the Master's Degree. In this class students have the first contact with digital forensic software like FTK Imager, Autopsy, ProDiscover Basic, and OSForensics.

Students will be using FTK Imager, Magnet Encrypted Disk Detector, OS Forensics Volatility Workbench, Kali Linux, Reg Ripper, Network Miner, and Wireshark to develop a foundation framework for the practice of Digital investigations, including technical and managerial issues.

Students will develop the ability to write basic python scripts (WIngIDE) to help in digital investigations. Students will also interpret scripts written in other languages, like EnCase Enscript or Perl or Microsoft Powershell or UNIX Shell Script.

Students will use tools such as The Sleuth Kit and Volatility to conduct forensic analysis of PC & server operating systems and software running on those systems, while gaining a knowledge set of forensic relevant information about operating systems, including those used in mobile devices. Finally, students will look at the challenges of virtualization, including those that come with the growth of Cloud systems.

In this class, students use tools like nfdump, Snort and Wireshark for network forensic analysis in the context of the role of an incident response team.

This course will teach the concepts and techniques needed to preserve and analyze data on a range of mobile electronic devices, including mobile phones, tablets, eBook readers, and GPS systems. Some of the tools used in this course are Magnet Forensics Axiom, Access Data FTK Imager, EnCase, Cellebrite Physical Analyzer, DB Browser, and Andriller.

In this class, students will assess and discuss the legal issues currently affecting the practice of digital forensics. Some of the highlights are the study of the following topics: “Cloud Act” and “Data Nationalism”; Supreme Court’s Efforts to Meet the Challenges of “Digital Evidence”; Encryption vs Privacy; and GDPR and the “Right to Be Forgotten.”

The course introduces principles of digital investigations that are specific to civil litigation. While litigation support services typically utilize many of the same tools, processes, and procedures as public sector criminal investigations, private sector use of computer forensics frequently involves issues that the public sector does not often consider, such as data recovery and restoration, erasure of media, and electronic discovery. Students will examine case studies of public sector digital investigations to compare with private sector methodologies.

The capstone class is a natural conclusion to the work in the entire program. Students will approach in this class something in the digital forensic field that has not been fully developed yet and will develop and present a methodology for performing forensic investigation in a way that improves what is already known.

In this course, students gain an insight into malware behavior, including infection vectors, propagation and persistence mechanisms, and artifacts. Some of the used tools are Pescanner, Xorserach, Interactive Disassembler Professional (IDA Pro), Mandiant IOC Editor, Ollydbg, Windbg, FindCrypt2, Krypto ANALyzer (KANAL), Volatility.

While using tools like Kerberos, openPGP and WireShark, students will learn encryption and hashing algorithm techniques and develop basic understanding of encryption cracking techniques and methods to counter whole-disk encryption and network based encryption.

In DFS-565, we discuss some of the challenges and decisions that confront managers, supervisors, and administrators in private and public lab environments. We will examine some of the special situations that professionals might encounter during digital forensics lab careers. This class is less focused on the technical aspects of digital forensics and more on some of the human aspects of managing people, making decisions, and managing administrative operations in the lab environment.