The goal of this course is to familiarize PhD students with scientific methods for the identification, collection and analysis of data while preserving the original evidence and the chain of responsibility in the process of identifying potential digital evidence. Also, students will learn about the processes of collecting, preserving, analyzing and presenting digital evidence, as well as relevant forensic tools.

Ability to contribute to scientific research. Student's ability to create and prepare scientific publications.. Ability to organize and control scientific projects. Students will focus on scholarly application of digital forensics.

1. The concept and development of digital forensics. Classification of forensic tools. 2. Analysis of forensic tools to implement and use areas. 3. Analysis of forensic tools to code and computing platform. 4. Forensic analysis tools used in different stages of the forensic investigation. 5. Forensic tool that analyzes the hardware. 6 Forensic tools that analyze code and programs. 7. Forensic tools that analyze operating systems and networks.

Students will become familiar with a number of forensic tools that will be applied in several case studies. The first case study is related to the analysis of hardware and restore data from damaged hardware. The second case study is related to the monitoring of the operating systems.

No preconditions.

All necessary programs can be found under the GNU license.

Total assigned hours: 65

New material: 30
Elaboration and examples (recapitulation): 20

Auditory exercises: 0
Laboratory exercises: 0
Calculation tasks: 0
Seminar paper: 0
Project: 0
Consultations: 0
Discussion/workshop: 0
Research study work: 0

Review and grading of calculation tasks: 0
Review and grading of lab reports: 0
Review and grading of seminar papers: 1
Review and grading of the project: 2
Test: 0
Test: 0
Final exam: 12

Activity during lectures: 5
Test/test: 0
Laboratory practice: 0
Calculation tasks: 0
Seminar paper: 0
Project: 45
Final exam: 50
Requirement for taking the exam (required number of points): 50

Eoghan Casey, Handbook of Digital Forensics and Investigation, Elsevier Inc, 2010; David Lilburn Watson, ‎Andrew Jones, Digital Forensics Processing and Procedures Meeting the Requirements of ISO 17020, ISO 17025, ISO 27001 and Best Practice Requirements, Elsevier Science, 2013