Title: IN 2005 Digital Forensics

Introductory Module - Begin Here
  Class Information
  Setting Notification Preferences
  Browsers that Canvas supports and what to do when browsers block content
  Creative Commons Information
  Purpose of this Course
  Teaching Material Certification Statement
  Post and Reply to a Post
  Ask the Instructor
Module 1: Chapter 1 - Computer Forensics and Investigations as a Profession
  Review the Objectives and Activities List below:
  Module 1 Objectives and Activities
  Complete the following Learning Activities:
  Chapter 1 Instructor Notes
  1. Understanding Computer Forensics
  2. Preparing for Computer Investigations
  Submit these Assessment Tasks by the due date:
  01: Introductions
  Chapter 1 Discussion Question
  Case Project 1-1
  Syllabus Quiz
  Course Contract Agreement
  IN2005CH01QZ
Module 2: Chapter 2 - Understanding Computer Investigations
  Review the Objectives and Activities List below:
  Module 2 Objectives and Activities
  Complete the following Learning Activities:
  Chapter 2 Instructor Notes
  1. Taking a Systematic Approach
  2. Procedures for Corporate High-Tech Investigations
  3. Understanding Data-Recovery Workstations and Software
  4.Conducting an Investigation
  5. Completing the Case
  6. Critiquing the Case
  Submit these Assessment Tasks by the due date:
  Chapter 2 Discussion Question
  Chapter 2 Case Projects
  IN2005CH02QZ
Module 3: Chapter 3 - Planning for Contingencies
  Review the Objectives and Activities List below:
  Module 3 Objectives and Activities
  Complete the following Learning Activities:
  Chapter 3 Instructor Notes
  1. Understanding Forensic Lab Certification Requirements
  2. Determining the Physical Requirements for a Computer Forensics Lab
  3. Selecting a Basic Forensic Workstation
  4. Building a Business Case for Developing a Forensics Lab
  Submit these Assessment Tasks by the due date:
  Chapter 3 Discussion Question
  Case Project 3-2
  IN2005CH03QZ
Module 4: Chapter 4 - Data Acquisition
  Review the Objectives and Activities List below:
  Module 4 Objectives and Activities
  Complete the following Learning Activities:
  Chapter 4 Instructor Notes
  1. Understanding Storage Formats for Digital Evidence
  2. Determining the Best Acquisition Method
  3.Contingency Planning for Image Acquisitions
  4. Using Acquisition Tools
  5. Validating Data Acquisitions
  6. Performing RAID Data Acquisitions
  7.Using Remote Network Acquisitions Tools
  8. Using Other Forensics-Acquisition Tools
  Submit these Assessment Tasks by the due date:
  Chapter 4 Discussion Question
  Case Project 4-2, 4-3, 4-4
  IN2005CH04QZ
Module 5: Chapter 5 - Processing Crime and Incident Scenes
  Review the Objectives and Activities List below:
  Module 5 Objectives and Activities List
  Complete the following Learning Activities:
  Chapter 5 Instructor Notes
  1. Identifying Digital Evidence
  2. Collecting Evidence in Private-Sector Incident Scenes
  3. Processing Law Enforcement Crime Scenes
  4. Preparing for a Search
  5. Securing a Computer Incident or Crime Scene
  6. Seizing Digital Evidence at the Scene
  7. Storing Digital Evidence
  8. Obtaining a Digital Hash
  9. Reviewing a Case
  Submit these Assessment Tasks by the due date:
  Chapter 5 Discussion Question
  Case Project 5.2
  IN2005CH05QZ
Module 6: Chapter 6 - Working with Windows and DOS Systems
  Review the Objectives and Activities List below:
  Module 6 Objectives and Activities List
  Complete the following Learning Activities:
  Chapter 6 Instructor Notes
  1. Understanding File Systems
  2. Exploring Microsoft File Structures
  3. Examining NTFS Disks
  4. Understanding Whole Disk Encryption
  5. Understanding the Windows Registry
  6. Understanding Microsoft Startup Tasks
  7. Understanding MS-DOS Startup Tasks
  8. Understanding Virtual Machines
  Submit these Assessment Tasks by the due date:
  Chapter 6 Discussion Question
  Case Project 6.2
  IN2005CH06QZ
Module 7: Chapter 7 - Current Computer Forensics Tools
  Review the Objectives and Activities List below:
  Module 7 Objectives and Activities List
  Complete the following Learning Activities:
  Chapter 7 Instructor Notes
  1. Evaluating Computer Forensics Tool Needs
  2. Computer Forensics Software Tools
  3. Computer Forensics Hardware Tools
  4. Validating and Testing Forensic Software
  Submit these Assessment Tasks by the due date:
  Chapter 7 Discussion Question
  Case Project 7.4
  IN2005CH07QZ
Module 8: Chapter 8 - Macintosh and Linux Boot Processes and File Systems
  Review the Objectives and Activities List below:
  Module 8 Objectives and Activities List
  Complete the following Learning Activities:
  Chapter 8 Instructor Notes
  1. Understanding the Macintosh File Structure and Boot Process
  2. Exploring Macintosh Boot Tasks
  3. Examining UNIX and Linux Disk Structures and Boot Processes
  4. Understanding Other Disk Structures
  Submit these Assessment Tasks by the due date:
  Chapter 8 Discussion Question
  Case Project 8-1
  IN2005CH08QZ
  IN2005 Midterm
  Major Summative Assessment Task (MSAT)
Module 9: Chapter 9 - Computer Forensics Analysis and Validation
  Review the Objectives and Activities List below:
  Module 9 Objectives and Activities List
  Complete the following Learning Activities:
  Chapter 9 Instructor Notes
  1. Determining What Data to Collect and Analyze
  2. Using AccessData Forensic Toolkit to Analyze Data
  3. Validating Forensic Data
  4. Addressing Data-hiding Techniques
  5. Performing Remote Acquisitions
  Submit these Assessment Tasks by the due date:
  Chapter 9 Discussion Question
  Case Project 9.2, 9.3
  IN2005CH09QZ
  Major Summative Assessment Task (MSAT)
Module 10: Chapter 10 - Recovering Graphics Files
  Review the Objectives and Activities List below:
  Module 10 Objectives and Activities List
  Complete the following Learning Activities:
  Chapter 10 Instructor Notes
  1. Recognizing a Graphics File
  2. Identifying Unknown File Formats
  3. Identifying Copyright Issues with Graphics
  Submit these Assessment Tasks by the due date:
  Chapter 10 Discussion Question
  Case Project 10.2, 10.3
  IN2005CH10QZ
  Major Summative Assessment Task (MSAT)
Module 11: Chapter 11 - Virtual Machines, Network Forensics, and Live Acquisitions
  Review the Objectives and Activities List below:
  Module 11 Objectives and Activities List
  Complete the following Learning Activities:
  Chapter 11 Instructor Notes
  1. Network Forensics Overview
  2. Performing Live Acquisitions
  3. Developing Standard Procedures for Network Forensics
  4. Using Network Tools
  5. Examining the Honeynet Project
  Submit these Assessment Tasks by the due date:
  Chapter 11 Discussion Question
  Case Project 11-1
  IN2005CH11QZ
  Major Summative Assessment Task (MSAT)
Module 12: Chapter 12 -E-mail Investigations
  Review the Objectives and Activities List below:
  Module 12 Objectives and Activities List
  Complete the following Learning Activities:
  Chapter 12 Instructor Notes
  1. Exploring the Role of E-mail in Investigations
  2. Exploring the Roles of the Client and Server in E-mail
  3. Investigating E-mail Crimes and Violations
  4. Understanding E-mail Servers
  5. Using Specialized E-mail Forensics Tools
  6 Managing Investigations in the Organization
  MSAT Example
  Submit these Assessment Tasks by the due date:
  Chapter 12 Discussion Question
  Case Projects 12-3 & 12-4
  IN2005CH12QZ
  Major Summative Assessment Task (MSAT)
Module 13: Chapter 13-Cell Phone and Mobile Device Forensics & Report Writing for High-Tech Investigations
  Review the Objectives and Activities List below:
  Module 13 Objectives and Activities
  Complete the following Learning Activities:
  Chapter 13 Instructor Notes
  1. Understanding Mobile Device Forensics
  2. Understanding Acquisition Procedures for Cell Phones and Mobile Devices
  Chapter 14 Instructor Notes
  1. Understanding the Importance of Reports
  2. Guidelines for Writing Reports
  3. Generating Report Findings with Forensics Software Tools
  Submit these Assessment Tasks by the due date:
  Chapter 13 Discussion Question
  Chapter 14 Discussion Question
  Case Project 13-1
  Case Project 14-1
  IN2005CH13QZ
  IN2005CH14QZ
  Major Summative Assessment Task (MSAT)
Module 14: Chapter 14-Expert Testimony in High-Tech Investigations & Ethics for the Expert Witness
  Review the Objectives and Activities List below:
  Module 14 Objectives and Activities List
  Complete the following Learning Activities:
  Chapter 15 Instructor Notes
  1. Preparing for Testimony
  2. Testifying in Court
  3. Preparing for a Deposition
  4. Preparing Forensics Evidence for Testimony
  Chapter 16 Instructor Notes
  1. Applying Ethics and Codes to Expert Witnesses
  2. Organizations with Codes of Ethics
  3. Ethical Difficulties in Expert Testimony
  Submit these Assessment Tasks by the due date:
  Chapter 15 Discussion Question
  Chapter 16 Discussion Question
  Case Projects 15-2 & 15-3
  Case Projects 16-1 & 16-3
  IN2005CH15QZ
  IN2005CH16QZ
  Major Summative Assessment Task (MSAT)
Module 15: MSAT Due XXXXXX
  Review the Objectives and Activities List below:
  Module 15 Objectives and Activities List
  Submit these Assessment Tasks by the due date:
  Major Summative Assessment Task (MSAT)
Module 16: Final Exam -
  Review the Objectives and Activities List below:
  Module 16 Objectives and Activities List
  Submit these Assessment Tasks by the due date:
  IN2005_Final_2014