From: Subject: FOR 240: Course Overview & Syllabus Date: Fri, 29 Aug 2008 13:50:21 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Content-Location: file://C:\Documents and Settings\jenica.norrish\Local Settings\Temporary Internet Files\Content.Outlook\N9CHF4ID\Gonyea_Fall08_FOR240_Course_Overview_and_Syllabus_.html X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3350 FOR 240: Course Overview & Syllabus
 

Computer Forensics I
FOR 240

Course Overview & Syllabus

Mark Gonyea=20





Hello! and welcome to Computer = Forensics=20 I. I hope that you find the course fun and interesting.

3D"Inet

This course covers topics related to criminal = justice and=20 computer technology and is, by it's nature, a multi-disciplinary = course =97=20 which is why this course was originally team developed and taught by a = computer guy and a police officer. Forensics is the use of = science in a=20 court of law; this course looks specifically at how one obtains = evidence off=20 of a computer and from network messages and logs, preserving the = evidentiary=20 chain, and the legal aspects of the search and seizure of computers = and=20 related equipment/information. To that end, we will cover a large set = of=20 topics, including:

This course will present varying levels of detail on = the=20 topics above. It is expected that technology students will be more = familiar=20 with computers and networks than the Criminal Justice students but = less=20 familiar with the legal aspects, and vice versa. Part of the course = experience=20 will be the blending of student expertise in the formation of teams. = This is=20 intended to be a general, practical course.

Course = prerequisite:=20 NET 120 (Computers and Telecommunications)

It is expected that incoming students to this course = have=20 basic familiarity with computers, the Internet, and the = law.

Student=20 outcomes:

Upon completion of this course, students will be = able to:=20

Instructor contact information:
  Mark Gonyea
  FBI San Diego
Regional = Computer=20 Forensics Lab
  9797 Aero Dr
San Diego, CA
Phone:
Fax:
Cell phone:
E-mail:
Immediate contact=20 email
+1 208 693 9557

mailto:gary.kessler@champlain.= edu

Texts and supplementary resources:

The first required text for this course is = Computer=20 Forensics: Principles and Practices by Linda Volonino, Reynaldo = Anzaldua,=20 and Jana Godwin (Pearson Prentice-Hall, 2007). This book is a very = good =97 and=20 highly readable =97 introductory text. It is not the complete = work on=20 computer forensics, however, and other readings from the Web and = handouts will=20 also be assigned to supplement the text. (Disclosure notice: = Gary C.=20 Kessler is listed as a contributing author of this book largely = because the=20 book's authors used some of the papers from the GaryKessler.net Web = site. Gary=20 receives no financial incentive to use this book.)

The second required text for the course is = First=20 Responder's Guide to Computer Forensics by Richard Nolan et al. = (Carnegie=20 Mellon, 2005) (Source #1 | Source #2). This volume, a free download from the = Internet,=20 contains excellent information about the technical and legal aspects = of the=20 computer forensics process.

One of the definitive texts in this field is Digital Evidence and Computer Crime, 2nd = ed. by=20 Eoghan Casey (Academic Press, 2004). This book provides excellent = broad=20 coverage of the field, including computer and network basics, digital=20 investigations, legal issues, and computer crime. While an excellent=20 professional reference and graduate text, the book is a tough read at = the=20 introductory level. C&DF majors may wish to eventually purchase = this text.=20 (A review of this book can be found at GaryKessler.net.)

These are by no means the only books available on = this topic;=20 there are at least a dozen books currently available on computer = forensics and=20 each has its own strengths and weaknesses. Students are encouraged to=20 investigate other texts as their studies progress.

GaryKessler.net has a number of papers and = articles on=20 topics related to this course and you should feel free to read and = peruse=20 them! In addition, a set of computer forensics URLs, including many to = the=20 legal aspects, can be found at http://www.garykessler.net/library/forensicsurl.html<= /I>.

  Finally, be sure to = download the=20 free Adobe Acrobat reader to be able to view course lecture notes and = other=20 course resources.


Attendance, Homework, and Grading:

Active participation in this course is particularly = important=20 given the multidisciplinary nature of the subject matter and the=20 multidisciplinary makeup of the students in the class. Students will = be=20 assigned to teams comprising at least one criminal justice expert and = one=20 computer expert for at least one assignment; these teams will work = together so=20 that both "sides" learn about the other. Participation is also = important so=20 that you can take notes on the lectures and other activities that will = supplement the course instructional material. Also note that the = lecture is=20 not intended to replace actually reading the text book!

Homework and other assignments will also be given in = this=20 course. Homework assignments are generally due the week after = they are=20 distributed and case project assignments are due two weeks = after they=20 are assigned. The final project will be assigned approximately = a month=20 before it is due.

There is a writing assignment that will be = periodically=20 assigned called the "Computer Crime Topic of the Week (TOW)." This is = a one-=20 to two-page (single-spaced) assignment, consisting of a summary of the = current=20 reading assignment plus a brief piece of independent research =97 = something from=20 a Web site, news report, or other timely item that relates to the = reading. I'd=20 like to know what you found important or significant about the week's = reading;=20 what interested you, what resonated, what was new, etc., etc. =97 and=20 why? Cite the relevant article or URL, and describe why you = chose that=20 article and why you think it important. Think critically about these = issues=20 and involve yourself in your writing =97 e.g., outlawing certain = activities to=20 aid law enforcement might sound good at first blush but does it really = make=20 sense; why or why not? The TOW needs to relate to the reading but can = come=20 from anywhere: a mailing list that you monitor, some security-related = site, a=20 friend, the Burlington Free Press, an experience from your = workplace,=20 etc. Use your imagination and get used to thinking about = this.

Each of you will be asked to present at least one of = your TOWs=20 to the class. And remember this quote from Herb Caen, former columnist = for the=20 San Francisco Chronicle: "Any clod can have the facts, but = having an=20 opinion is an art." Have an opinion!!!

There will be a final project in this course where = you need to=20 do some research on pretty much any computer foresnics-related topic = of your=20 choice. The project will have two parts; a paper and a presentation. = More=20 detail will be provided during the semester but you can start thinking = about=20 topics at any time.

Finally, all = assignments=20 have a due date. Late assignments will be accepted only in = extraordinary=20 circumstances and only with the instructor's permission. = Please=20 note that "notifying" me that an assignment will be late is not = the=20 same as getting my permission!

Final course grades will be calculated roughly as=20 follows:

  • Homework assignments (10): 20%=20
  • Case project assignments (4): 20%=20
  • Final project paper/"presentation": 10%=20
  • Attendance and participation: 15%=20
  • Presentation of your TOW: 5%=20
  • Midterm: 15%=20
  • Final Exam: 15%

The College's standard numerical scale for = calculating final=20 grades is as follows:

A A- B+ B B- C+ C C- D+ D D- F
93+ 90 87 83 80 77 73 70 67 63 60 59-

Applicability of Core Competencies

The Champlain College faculty and administration = have=20 committed that our curricula will address these seven critical core=20 competencies:

  • Technology=20
  • Critical and Creative Thinking=20
  • Global Awareness=20
  • Oral Communication=20
  • Written Communication=20
  • Quantitative Literacy=20
  • Ethical Reasoning

This course addresses these competencies as outlined = below.

Technology

This course covers basic concepts related to = computers and=20 networks, the application of this technology to law enforcement and=20 information security incident response, and the relationship of = current laws=20 to this technology. Analysis of the contents of computers and network = traffic=20 is a growing field affecting business, government, the military, = education,=20 and more. This course discusses a wide range of issues related to = computer,=20 network, and telecommunications technologies, including hardware, = operating=20 systems, software, network applications, and communication=20 protocols.

Critical and Creative Thinking

Due to the broad and highly technical nature of = computer and=20 network forensics, the ability to think critically must become second = nature=20 to its practitioners. While there are some well-defined processes and=20 procedures for the forensic analysis of computers, every scenario is = slightly=20 different and forensic computing remains as much art as it is science. = By=20 discussing and analyzing various real and hypothetical case scenarios, = students will learn how to determine what needs to be analyzed, what = evidence=20 is being sought, what tools are most applicable to the task at hand, = and the=20 most efficient way to perform the analysis.

In any computer examination, the individual = component must be=20 understood as well as the big picture. Computers are examined as part = of a=20 larger investigation; the very nature of this business is critical=20 thinking.

And there is more. A digital forensics examiner must = analyze=20 someone else's computer in the context of some event and think like = that other=20 person. Everything done on a computer or on the Internet leaves a = trace; the=20 digital forensics professional has to find those traces =97 and that = means being=20 able to think like the Bad Guy.

Critical thinking is reinforced by homework = assignments and=20 classroom discussions. Rather than focus on bare "facts," the homework = and=20 class meetings focus more on how the subject matter integrates with = other=20 things that student know and will learn in the future. We also examine = how=20 students attitudes change as their level of knowledge =97 and = responsibility =97=20 changes.

Global Awareness

International awareness is not a major focus of this = course=20 and, in fact, there are few aspects of computer forensics that are=20 geography-specific. The technology is relatively universal and, = therefore, the=20 technical solutions are universal. Laws, however, vary = country-by-country so=20 that actions that are illegal in some countries are legal in others = (such as=20 unleashing a virus). Although not emphasized, the course does describe = some of=20 the geographical, political, and cultural differences as they apply to = legal=20 aspects, privacy expectations, and cooperation between law enforcement = agencies from different countries.

Oral and Written Communication

Computer forensics is a part of the overall criminal = justice=20 process and can be made totally useless if the investigator cannot = effectively=20 communicate forensics findings both in written form (such as a report = or other=20 affidavit) and verbal form (such as a deposition or court testimony). = These=20 skills will extend those learned in other classes by use of papers, = student=20 presentations, and the demonstration of proper computer forensics=20 techniques.

The digital forensics professional must be able to = communicate=20 to many audiences on many levels:

  • Communication with peers and managers at the = technical=20 level. This requires an understanding of computer, networking, and = security=20 concepts, as well as the proper vernacular.=20
  • Communication with attorneys, judges, juries, and = users,=20 generally at a non-technical level. A successful technologist must = be able=20 to communicate the technical findings in an understandable and = compelling=20 way. This is often the most challenging portion of a professional's=20 development.=20
  • Communication with individuals at all levels = within an=20 organization with all levels of understanding. This includes upper=20 management and supervisors to peers and subordinates, ranging from = the=20 technophobe to the technophile.

This course will provide students with ample = opportunity to=20 practice their communication skills through the weekly homework = assignments=20 and classroom discussions, but even more so through the research = project that=20 is part research paper, part oral presentation, and part presentation=20 graphics. All assignments include grammar and composition as a = component of=20 grading.

Quantitative Literacy

Digital forensics professionals have to be able to = analyze=20 patterns of activity to differentiate between normal and abnormal = activity, as=20 well as to find information within the context of an investigation. = Most of=20 the information on computers and networks involves numbers and = symbols, and=20 the computer/network analyst needs to be able to find the events that = are=20 pertinent to a case =97 both incriminating and exculpatory. This = course will=20 provide students with ample opportunity to practice quantitative = literacy=20 through the weekly homework assignments and classroom = discussions.

Ethical Reasoning

The use of networks and information often requires = ethical=20 considerations =97 e.g., how to employ individuals' private = information that is=20 stored on a computer or Web site, adherence to usage polices and the = law, and=20 how to respond to a potentially unethical request by a supervisor.=20 Furthermore, computer forensics managers are involved in the discovery = of=20 information that can be used as evidence against them =97 or to = support them.=20 The responsibility of the computer forensics examiner is high and = ethical=20 behavior is a key element in one's credibility. Ethical reasoning is=20 specifically addressed in this course.

Students with Disabilities

If you believe that you have a disability requiring=20 accommodations in this class, please contact the Coordinator of = Support=20 Services for Students with Disabilities as soon as possible. After you = receive=20 your accommodation form, please see me so I can work with you to = implement=20 them in a timely fashion.

Contact: Allyson Krings, Coordinator of = Support=20 Services for Students with Disabilities (Hauke 007i, 802-651-5961, krings@champlain.edu)

=

Academic Honesty Policy

The Champlain College Student Handbook (The = Rudder)=20 describes the College's Academic Honesty policy. If the instructor = suspects=20 that a student has plaigarzied or otherwise cheated on an assignment = =97 i.e.,=20 to either actually or attempt to knowingly give, receive, or use work = that is=20 not your own =97 the instructor can give a 0 on that = assignment.

This is not to suggest that the college or the = program=20 discourages your collaboration with students and others; in fact, we = encourage=20 as much collaboration as possible. The point of this policy is that = work that=20 you submit as your own has to be your own! If you work with = another=20 person or other resource that helps you learn an answer to something, = that's=20 fine =97 but what you turn in should be in your own words and clearly=20 demonstrate your understanding. If you're unsure, indicate on = your=20 paper that you worked with others.

Don't cheat; there's no margin in it!! If you = have a=20 problem, talk to me instead.