ITI5223 · IT forensics

Overview

This unit provides a broad coverage of (digital) IT forensics. You will examine definitions of evidence as they apply to investigations involving the seizure and examination of information technology devices. The unit will introduce you to various tools, techniques and algorithms that may be employed by investigators for acquisition, preservation, and analysis of evidence. Disk-based (local) and network (remote) forensic environments will be explored. You will also learn of the impediments and complicating factors that can threaten forensic investigations.

Offerings

Assessment

The Handbook does not list a final examination among the assessment items. That is not a guarantee there is none.

This unit has threshold mark hurdles. You must achieve at least 45% of the available marks in the final scheduled assessment, at least 45% in total for in-semester assessments, and an overall unit mark of 50% or more to be able to pass the unit. If you do not achieve the threshold mark, you will receive a fail grade (NH) and a maximum mark of 45 for the unit.

Assessment details may change. Please refer to the assessment information in Moodle closer to the start of the teaching period.

Requisites

Learning outcomes

1. explain the motivations and landscape of forensic investigations in an IT context;
2. explain the relevant legal definitions and frameworks that apply to digital forensic investigations;
3. select appropriate tools and algorithms to perform forensic investigations and acquire relevant evidence;
4. apply and evaluate forensic techniques in local media-based and network-based environments;
5. report on forensic findings in a clear and concise manner;
6. demonstrate how digital forensics can be employed by Police and Tax officials in a court of law.

Workload

Minimum total expected workload to achieve the learning outcomes for this unit is 144 hours per semester typically comprising a mixture of scheduled online and face to face learning activities and independent study. Independent study may include associated reading and preparation for scheduled activities. The unit requires on average three/four hours of scheduled activities per week. Scheduled activities may include a combination of teacher directed learning and online engagement.

Student experience, not official rules. Nothing here changes what the Handbook says.