Fundamentals of digital forensicsSyllabus

Subject code

İF-2215y

Credits

8

Student workload

150

Semester

Autumn semester

Academic year

4

Subject type

Mandatory

Form of education

Full-time

Language of instruction

Azerbaijani

In-class hours

a) 30 saat - mühazirə b) 30 saat - seminar c) 30 saat - laboratoriya

Out-of-class hours

a) 90 saat – sərbəst iş b) 60 saat – layihə işi və ya məsləhət saatı

The subject provides students with the formation of theoretical knowledge and practical skills in the investigation of security incidents and the implementation of digital forensics processes. within the subject, the basic concepts, types and principles of digital forensics, as well as the processes of identification, collection, documentation, storage, protection, analysis and presentation of digital evidence are studied. students are introduced to forensic investigation techniques on disks and file systems, windows and linux systems, deleted files, image and log files, network traffic, and memory (ram). also considered are forensic analysis of web attacks, mobile devices, email, cloud and virtual environments, as well as incident response. application features of open-source and commercial tools used for obtaining and analyzing digital evidence are explored. the subject also covers legal and ethical issues of digital forensics, investigative reporting and presentation in court.

• lecture
• laboratory work
• presentations
• seminar
• interactive discussion
• problem-based learning
• case study

1. 1

   CLO 1: Must understand the role and importance of forensic computer science/digital forensics, know its types, understand and apply research methods.

2. 2

   CLO 2: Must be able to distinguish digital evidence that has evidentiary value, understand their types and importance.

3. 3

   CLO 3: Must learn the procedural basics of identification, collection, documentation, storage, use, preservation and presentation of digital evidence.

4. 4

   CLO 4: Must acquire knowledge and skills in using the necessary resources and equipment to identify, collect, document, store, use, protect and present digital evidence, as well as be able to apply open source and advanced solutions.

5. 5

   CLO 5: Must be able to perform forensic diagnostics of digital evidence, evaluate results obtained and formulate conclusions.

6. 6

   CLO 6: Must know the necessary legal procedures and requirements to ensure the availability of evidence

1. 1.
   Introduction to digital forensicsLecture

   Within the scope of the topic, the essence, purpose and basic concepts of digital forensics are studied. the role of digital forensics in the investigation of security incidents and cybercrimes, its main application areas and its relation to other areas of cyber security are reviewed. the concept of digital evidence, the main characteristics of digital evidence and the general stages of a forensic investigation are explained. it also examines the importance of preserving the integrity and reliability of evidence when conducting digital forensics.

2. 2.
   Digital forensics toolsLecture

   Within the framework of the topic, the main tools used in digital forensic investigations and their application directions are studied. the functions of various types of forensics tools used for the acquisition, preservation, processing, recovery and analysis of digital evidence are reviewed. the categories of tools and their selection criteria used to examine disk, file system, memory, network, and other digital data sources are explained. also, open source and commercial forensics solutions are analyzed and their role in the investigation process.

3. 3.
   Disks and file systemsLecture

   Within the framework of the topic, the basic concepts of disk structure and file systems are studied from the point of view of digital forensic investigations. the physical and logical structure of the hard disk, the principles of data storage and access to memory media are reviewed. the role of file systems in the organization and management of information, the main structural elements and principles of operation are explained. it also examines the importance of disk and file system structures in the detection, retrieval, and analysis of digital evidence.

4. 4.
   Windows forensicsLecture

   Within the framework of the topic, the principles of conducting digital forensic investigations and analysis of malware-based attacks on windows operating systems are studied. the primary sources of information from which digital footprints and potential evidence can be obtained are reviewed in the windows system. approaches to identifying system changes, suspicious processes, files, and other traces of activity caused by malicious programs are explained. also, analysis of attack activities and their impact on the system is investigated based on the obtained digital artifacts.

5. 5.
   Linux forensicsLecture

   Within the framework of the topic, the principles of conducting digital forensic investigations and analysis of security incidents based on log data are studied in linux operating systems. the main log sources from which information about security events and user activities on linux systems can be obtained are reviewed. methods for identifying and analyzing logs related to system access attempts, user and process activities, services, and other suspicious events are explained. also, issues of determining the sequence of occurrence and possible causes of the incident are investigated based on the correlation of different log sources.

6. 6.
   Recover deleted filesLecture

   Within the framework of the topic, the principles and basic methods of recovery of deleted files from the point of view of digital forensics are studied. after the file is deleted, the features of data storage in the storage medium and the principles of operation of the deletion process in different file systems are reviewed. basic approaches and forensics tools used to detect and recover deleted data are explained. also, based on the analysis of file system structures, issues of assessment of recovery possibilities and protection of obtained data as digital evidence are investigated.

7. 7.
   Forensics of image filesLecture

   Within the framework of the topic, the principles of digital forensic analysis of image files and their authenticity assessment are studied. the main methods used to detect changes, manipulations and edit traces on image files are reviewed. analyzing the structure and metadata information of images, as well as approaches to identifying possible inconsistencies in files, are explained. also, the issues of detection and analysis of information and messages hidden within the image with steganography methods are investigated.

8. 8.
   Examining log filesLecture

   Within the framework of the topic, the role of log files in digital forensic investigations and the principles of their analysis are studied. the structure and basic data elements of log records generated by various network protocols and network services are reviewed. methods for identifying connections, user activities, access attempts, and suspicious network events based on logs are explained. also, issues of creating a time sequence of events and investigating security incidents are studied based on the coordination of various log sources.

9. 9.
   Examining network trafficLecture

   Within the framework of the topic, the principles of network traffic analysis in digital forensic investigations are studied. the working principles of switching and routing processes during data transmission in the network and their role in the formation of traffic flow are considered. the characteristics of traffic transmitted between local and different networks, the direction of movement of packets and the functions of network devices in this process are explained. it also investigates the identification of suspicious connections, unusual traffic flows and potential security incidents based on network traffic analysis.

10. 10.
    Investigating web attacksLecture

    Within the framework of the topic, the principles of investigating attacks against web applications from the point of view of digital forensics are studied. key indicators of web application attacks, suspicious requests, unusual user activities, and other digital traces generated in the system are reviewed. techniques for detecting attack symptoms and determining the time sequence of events based on web server, application, and security logs are explained. also, on the basis of the obtained indicators, the issues of determining the type of attack, its source, the methods used and its possible effects are investigated.

11. 11.
    Mobile device forensicsLecture

    Within the framework of the topic, the principles of digital forensic investigation of mobile devices and data acquisition from these devices are studied. key features of call logs, messages, contacts, application data, media files, and other digital artifacts stored on mobile devices are reviewed. basic data acquisition methods, such as logical, file system, and physical extraction from mobile devices, and their application characteristics are explained. also, issues of protecting the integrity of digital evidence during data extraction and preparation of obtained data for forensic analysis are investigated.

12. 12.
    Forensics in e-mail, cloud and virtual environmentsLecture

    Within the framework of the topic, the principles of conducting digital forensic investigations in e-mail, cloud services and virtual environments are studied. the sources of digital evidence available in these environments and the technical characteristics that affect the acquisition of evidence are reviewed. methods for collecting data stored on virtual machines, virtual disk files, configuration data, snapshots, and system logs are explained. also, the issues of protecting the integrity of the data during the acquisition of digital evidence and preparing the obtained artifacts for forensic analysis are investigated.

13. 13.
    Memory (ram) forensicsLecture

    Within the framework of the topic, the principles of digital forensic investigation of random access memory (ram) and acquisition of variable data are studied. processes, network connections, user sessions, encryption keys, and other forensically important information available in the RAM memory of a running system are reviewed. the basic techniques used to safely extract data from RAM and create a memory image are explained. also, the issues of preservation of obtained memory data and preparation for subsequent forensic analysis are investigated.

14. 14.
    Legal and ethical issues of digital forensicsLecture

    Legal and ethical principles to be taken into account when conducting digital forensic investigations are studied within the subject. basic requirements for lawful acquisition, preservation, analysis and presentation of digital evidence are reviewed. the principles of chain of custody, which ensures the documentation of the movement and access to the evidence from the moment it is obtained until it is presented to the court, are explained. also, the issues of objective and clear documentation of investigation results, preparation of forensic reports and presentation of digital evidence in court are investigated.

1. Easttom c., CCFP certified cyber ​​forensics professional certification all-in-one, mcgraw-hill education, 2015
2. Brooks c. l., CHFI computer hacking forensic investigator certification all-in-one, mcgraw-hill education, 2015
3. Nelson b., phillips a., steuart c., guide to computer forensics and investigations: processing digital evidence, cengage learning, 2018
4. Thomas j. h., bossler a. m., seigfried-spellar k., cybercrime and digital forensics: an introduction, routledge, 2017
5. Kävrestad j., fundamentals of digital forensics: theory, methods, and real-life applications, springer, 2018
6. Altheide c., nikkel b., carvey h., digital forensics with opensource tools: using opensource platform tools for performing computer forensics on target systems: windows, mac, linux, unix, etc., elsevier science & technology, 2011.
7. Altheide c., nikkel b., carvey h., digital forensics with opensource tools: using opensource platform tools for performing computer forensics on target systems: windows, mac, linux, unix, etc., elsevier science & technology, 2011.
8. Brooks c. l., CHFI computer hacking forensic investigator certification all-in-one, mcgraw-hill education, 2015
9. 3.easttom c., CCFP certified cyber forensics professional certification all-in-one, mcgraw-hill education, 2015