Forensic Computing and Electronic Evidence
Module summary
This module provides an introduction to the practical aspects of forensic computing investigations, and offers a legal overview of legislation and the main legal issues related to cyber-crime and computer forensics.
We will investigate cyber-crimes, the electronic evidence that they generate and the methods used in finding, recovering and analyzing this evidence from individual computers and from networks. The module will also explore the legislation related to cyber-crime, including some substantive and procedural law provisions from US, Europe and the UK.
Session titles
- Cyber-crimes
- Computer vulnerabilities
- 'Deleted' data and evidence recovery
- Cyber-crime: the legal view
- Investigative process
- Beyond the PC: evidence recovery from networks and the internet
- Beyond keywords: finding and analyzing electronic evidence
- Beyond cyber-crime legislation: legal issues in electronic evidence
- Before and after an investigation: forensic readiness, experts in the courtroom
- Future challenges
Learning outcomes
By the end of this module you should be able to:
- critically discuss the main kinds of cyber-crimes, and commonly exploited computer vulnerabilities
- relate the importance of electronic evidence and assess the level of access required to obtain certain electronic information
- outline the main European, US and UK legislation relating to cyber-crime and to electronic evidence, and of some strengths, weaknesses and controversial issues
- understand the practical problems of discovering electronic evidence and gain some basic experience in electronic evidence acquisition
- make deductions and build a case based on electronic evidence
- apply some 'best practices' in preparing for incidents of computer mis-use, responding to incidents, and presenting electronic evidence in the courtroom;
- analyse future challenges related to electronic evidence.
Assessment
One essay, 5000 words (60%); one piece of assessed course work (20%); participation in online activity (20%).
