Scribd
Upload
36 views3 pages

DF Syllabus

Digital Forensics

Uploaded by

Andrea Fernandes
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
36 views3 pages

DF Syllabus

Digital Forensics

Uploaded by

Andrea Fernandes
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

Course Code: Course Title Credit

CSDC8012 Digital Forensics 3

Prerequisite: Computer Network, Cryptography and System Security


Course Objectives:
1 To discuss the need and process of digital forensics and Incident Response Methodology.
2 To explore the procedures for identification, preservation, and acquisition of digital
evidence.
3 To explore techniques and tools used in digital forensics for Operating system and malware
investigation .
4 To explore techniques and tools used for Mobile forensics and browser, email forensics

Course Outcomes:
1 Discuss the phases of Digital Forensics and methodology to handle the computer security
incident.
2 Describe the process of collection, analysis and recovery of the digital evidence.
3 Explore various tools to analyze malwares and acquired images of RAM/hard drive.
4 Acquire adequate perspectives of digital forensic investigation in mobile devices
5 Analyze the source and content authentication of emails and browsers.
6 Produce unambiguous investigation reports which offer valid conclusions.

Module Content Hrs


1 Introduction to Digital Forensics 6
1.1 Digital ForensicsDefination, Digital Forensics Goals, Digital
Forensics Categories - Computer Forensics, Mobile Forensics,
Network Forensics, Database Forensics
1.2 Introduction to Incident - Computer Security Incident, Goals of
Incident Response, CSIRT, Incident Response Methodology, Phase
after detection of an incident
2 Digital Evidence, Forensics Duplication and Digital Evidence 9
Acquisition
2.1 Digital evidence, Types of Digital Evidence, Challenges in acquiring
Digital evidence, Admissibility of evidence, Challenges in evidence
handling, Chain of Custody
2.2 Digital Forensics Examination Process - Seizure, Acquisition,
Analysis, Reporting. Necessity of forensic duplication, Forensic
image formats, Forensic duplication techniques,.
2.3 Acquiring Digital Evidence - Forensic Image File Format, Acquiring
Volatile Memory (Live Acquisition), Acquiring Nonvolatile Memory
(Static Acquisition), Hard Drive Imaging Risks and Challenges,
Network Acquisition
3 Forensics Investigation 4
3.1 Analyzing Hard Drive Forensic Images, Analyzing RAM Forensic
Image, Investigating Routers
3.2 Malware Analysis - Malware, Viruses, Worms, Essential skills and
tools for Malware Analysis, List of Malware Analysis Tools and
Techniques
4 Windows and Unix Forensics Investigation 8
4.1 Investigating Windows Systems - File Recovery, Windows Recycle
Bin Forensics, Data Carving, Windows Registry Analysis, USB
Device Forensics, File Format Identification, Windows Features
Forensics Analysis, Windows 10 Forensics, Cortana Forensics
4.2 Investigating Unix Systems - Reviewing Pertinent Logs, Performing
Keyword Searches, Reviewing Relevant Files, Identifying
Unauthorized User Accounts or Groups, Identifying Rogue
Processes, Checking for Unauthorized Access Points, Analyzing
Trust Relationships
5 Mobile Forensics 8
5.1 Android Forensics, Mobile Device Forensic Investigation - Storage
location, Acquisition methods, Data Analysis
5.2 GPS forensics - GPS Evidentiary data, GPS Exchange Format
(GPX), GPX Files, Extraction of Waypoints and TrackPoints,
Display the Tracks on a Map.
5.3 SIM Cards Forensics - The Subscriber Identification Module (SIM),
SIM Architecture, Security, Evidence Extraction.

6 Browser, Email Forensic & Forensic Investigation Reporting 4


6.1 Web Browser Forensics, Google chrome, Other web browser
investigation
Email forensics - Sender Policy Framework (SPF), Domain Key
Identified Mail (DKIM), Domain based Message Authentication
Reporting and Confirmation (DMARC)
6.2 Investigative Report Template, Layout of an Investigative Report,
Guidelines for Writing a Report

Textbooks:
1 Kevin Mandia, Chris Prosise, ―Incident Response and computer forensics‖, Tata
McGrawHill, 2006
2 Digital Forensics Basics A Practical Guide Using Windows OS — Nihad A. Hassan,
APress Publication, 2019
3 Xiaodong Lin, ―Introductory Computer Forensics: A Hands-on Practical Approach‖,
Springer Nature, 2018

Suggested MOOC Course Links


1 Course on ―Ethical Hacking‖
https://nptel.ac.in/courses/106/105/106105217/
2 Course on ―Digital Forensics‖
https://onlinecourses.swayam2.ac.in/cec20_lb06/preview
3 Course on Cyber Incident Response
https://www.coursera.org/learn/incident-response
4 Course on ―Penetration Testing, Incident Responses and Forensics‖
https://www.coursera.org/learn/ibm-penetration-testing-incident-response-forensics
Assessment:

Internal Assessment:
Assessment consists of two class tests of 20 marks each. The first class test is to be conducted
when approx. 40% syllabus is completed and second class test when additional 40% syllabus is
completed. Duration of each test shall be one hour.

End Semester Theory Examination:


1 Question paper will comprise a total of six questions.
2 All question carries equal marks
3 Questions will be mixed in nature (for example supposed Q.2 has part (a) from module 3
then part (b) will be from any module other than module 3)
4 Only Four questions need to be solved.
5 In question paper weightage of each module will be proportional to the number of
respective lecture hours as mention in the syllabus.

You might also like