22VT - 2DV704 - Digital Forensics - 7,5 hp - Växjö - 25%
Avsnittsöversikt
-
Welcome to the course on Digital Forensics. The course is run as a flipped classroom course with mandatory seminars on different subjects connected to the Digital Forensics Process. Before each seminar you will prepare yourself by reading sections from the textbook and watching online recordings. For some of the seminars you will also have to complete practical work that we will discuss during the seminar.
The textbook we will use for the course is Digital Forensics - André Årnes et.al
-
For this seminar you should read chapter 1 in the textbook and watch the attached video.
-
For this seminar you should read chapter 2 in the textbook and watch the related videos.
-
For this seminar you should read chapter 3 and 4 in the textbook and watch the related videos.
-
For this seminar you should read chapter 5 in the textbook and watch the related videos.
You should also have started the Act 1 in DeterLab.
-
For this seminar you should read chapter 6 in the textbook and watch the related videos.
You should also have completed Act 1 in DeterLab.
Notice that you for this act need to work in the DeterLab environment. You should produce a forensics report to present your results. The structure of the report should be influenced by "Writing a forensics report" (Se Module "Practical Work Details") but also make sure you meet the requirements in Act 1 for what should be included in the report.
-
For this seminar you should read chapter 7 in the textbook and watch the related videos.
You should also complete and submit the report for Act 2 in DeterLab. If you didn't submit Act1 before, the re-take for Act 1 is also before this seminar.
-
For this seminar you should read chapter 8 in the textbook and watch the related videos.
You should also complete and submit the report for Act 2 in DeterLab if you didn't do it in the first round. -
This is a guest lecture from Combitech demonstrating forensic tools and how they work with digital forensics.
-
For this seminar you should just watch the related videos. There are no chapters in the textbook to cover.
You should also complete and submit the report for Act 3 in DeterLab. -
Title
Digital Forensics - important things to know during onsite investigations
Key concepts
Working as a digital forensic specialist, basic workflow, live forensics, memory forensics, decision making, considerations, risks, etc.
About the presenter
Peter Bayer has worked 20 years within the information security field focusing on IT security. Job descriptions have varied but included security review of source code, penetration testing and digital forensics. Peter has conducted more than 700 digital forensic investigations and been acting as an expert witness in court several times. Since 2011, he runs a business called Dingard AB in Växjö (Videum Science Park) focusing on security incidents and digital forensic investigations. -
Practical work will be performed on a system call DeterLab. This is a collaborative effort between many universities where different labs are developed and shared. In order to use the system you will need to have a user on the system. I will create these once the course has started.
https://www.isi.deterlab.net/file.php?file=/share/shared/Computerforensics
https://trac.deterlab.net/wiki/GettingStarted -
-
DigitalCorpora.org is a website of digital corpora for use in computer forensics education research. All of the disk images, memory dumps, and network packet captures available on this website are freely available and may be used without prior authorization or IRB approval. We also have available a research corpus of real data acquired from around the world. Use of that dataset is possible under special arrangement.
