Forensic Computing and Electronic Evidence

Please note this course will not be offered in the 2018/19 academic year. 

Course summary

This course provides an introduction to the practical aspects of forensic computing investigations, and offers a legal overview of legislation and the main legal issues related to cyber-crime and computer forensics.

We will investigate cyber-crimes, the electronic evidence that they generate and the methods used in finding, recovering and analyzing this evidence from individual computers and from networks. The course will also explore the legislation related to cyber-crime, including some substantive and procedural law provisions from US, Europe and the UK.

Weeks:

  1. Cyber-crimes
  2. Computer vulnerabilities
  3. 'Deleted' data and evidence recovery
  4. Cyber-crime: the legal view
  5. Investigative process
  6. Beyond the PC: evidence recovery from networks and the internet
  7. Beyond keywords: finding and analyzing electronic evidence
  8. Beyond cyber-crime legislation: legal issues in electronic evidence
  9. Before and after an investigation: forensic readiness, experts in the courtroom
  10. Future challenges

Learning outcomes

By the end of this course you should have:

  • critically discuss the main kinds of cyber-crimes, and commonly exploited computer vulnerabilities
  • relate the importance of electronic evidence and assess the level of access required to obtain certain electronic information
  • outline the main European, US and UK legislation relating to cyber-crime and to electronic evidence, and of some strengths, weaknesses and controversial issues
  • understand the practical problems of discovering electronic evidence and gain some basic experience in electronic evidence acquisition
  • make deductions and build a case based on electronic evidence
  • apply some 'best practices' in preparing for incidents of computer mis-use, responding to incidents, and presenting electronic evidence in the courtroom;
  • analyse future challenges related to electronic evidence.

Assessment

4000-word essay (60%); assessed course work (20%); participation in online activity (20%).

Terms and conditions

Please note the University reserves the right to make variations to the contents of programmes, including the range of courses offered, and the available choice of courses in any given year may change.

Find out more about the University's terms and conditions