Computer = Forensics II

FOR=20 340 Computer Forensics II

Melodie Woodward, B.S., = CCE

Welcome = to=20 Advanced Computer Forensics and the Computer and Digital and Computer = Forensics=20 major at Champlain College.

This = course is=20 designed to expose students to advanced concepts in digital/computer = forensic=20 analysis and Internet Investigations. As with the introductory course, = there=20 will be a balance of legal and technical aspects of study to achieve a = balance=20 similar to that encountered during common cases in which computer = forensics are=20 employed. Toward that end, the following topics will be = covered:

=20 =B7 =20 Introduction and Review of Basic Concepts

=B7 =20 Advanced Legal Concepts

=B7 =20 Subpoenas and Search Warrants

=B7 = Seizing digital media

=B7 = Imaging=20 & Authentication

=B7 =20 Forensic Hardware & Software

=B7 = Linux=20 as a forensic platform

=B7 =20 Analyzing Media with EnCase

=B7 =20 Analyzing Media with Forensic Toolkit

=B7 =20 Analyzing Media with ProDiscover

=B7 =20 File Systems

=B7 = Report=20 Writing for Computer Forensic Analysis

Course=20 Prerequisite: At least 30 credit hours and Intro to Computer=20 Forensics

Student=20 Outcomes:

Upon completion of this course students will be = able to:

=B7 =20 Demonstrate an ability to apply computer forensics to practical=20 investigations.

=B7 = Perform=20 cyber-research on various forensic topics.

=B7 = Analyze=20 case studies involving collaborative investigation.

=B7 =20 Describe the process of computer forensic analysis on an advanced = level.

=B7 = Articulate legal principles based on current case = law and=20 advanced concepts surrounding the 4^th Amendment.

=B7 =20 Construct a report of forensic analysis.

Relationship to=20 core competencies:

Technology:=20 This course is about new technologies, including computers and the=20 Internet. Students will be asked to perform some basic research = on the=20 Internet in addition to delving into other technologies. =

Writing:=20 To enhance the students=92 writing abilities, homework assignments and = the final=20 project will require students to write about the various forensic = technologies=20 and legal cases they learn about in class and through individual=20 research.

Communication:=20 The ability to explain, verbally and in writing, the technical issues = to both=20 peers and laypersons is essential in this field. To enhance the=20 student=92s presentation skills, various projects will be employed = requiring=20 students to present the results of their research to the class. =

Global=20 Perspectives: Students will review case studies that cross wide = geographic=20 boundaries and require collaborative investigation. This aspect = of=20 criminal investigation, particularly in crimes involving computers and = the=20 Internet, is becoming increasingly important for criminal = investigators. =20

Critical=20 Thinking: The course will introduce students to a variety of tools = available=20 to the forensic examiner. Much of the course will teach students = to=20 determine what the appropriate tool is for the examination of a given = piece of=20 digital evidence. Students also need to apply their own = experience and=20 judgment to determine if the results of the examinations seem = reliable. =20 This course further introduces students to a thought process that = requires=20 logic and creativity.

Instructor=20 contact information:

Melodie Woodward, = CCE

Champlain College

West Hall

Burlington, VT =20 05401

802-865-5455

melodie.woodward@champlain= .edu

AIM screen name: mwoodward23

Textbooks

We will = be=20 utilizing two books for this semester:

* Computer = Evidence=20 Collection and Preservation by Chris Brown

* Windows = Forensics: The=20 Field Guide for Conducting Corporate Compouter Invesigations by Chad = Steele

Attendance,=20 Homework, and Grading:

Attendance in this=20 course is important, not only because of the breadth of information to = be=20 presented but also because interaction with fellow students is critical = to the=20 course design. Class discussions will serve as important = cornerstones to=20 the learning process to allow students to glean information from their = peers not=20 available from other sources.

Homework = and=20 exercise assignments will be given.

=B7 =20 Each of these exercises will be conducted = during=20 a module. Each = paper/exercise is=20 due one week after it is assigned unless otherwise indicated. The assignment details are = located in=20 the assignment section of WebCT which is = where they=20 are to be submitted each week.

All assignments have a due date. = Late=20 assignments will be accepted only in extraordinary circumstances = and only with the = instructor's=20 permission. Please note that "notifying" me that an assignment will be = late is=20 not the same as = getting my=20 permission! All homework must be submitted via WebCT. = If you=20 have technical problems submitting via WebCT, email me=20 your assignment. If for = some reason=20 you can=92t hand in the homework on time, please make arrangements with = me prior to the date the = assignment is=20 due.

Class=20 Participation: Weekly interaction with class discussion is = expected,=20 and the class participation portion of the grade is based on the level = of=20 interaction and contribution to class discussions. There will be opportunity to = work in=20 small groups. This will = also=20 count towards your class participation. =20 Each class builds on the knowledge from the previous classes so = attendance is very important.

Grades = will be=20 calculated and weighted as follows:

Homework Assignments/Exercises =3D 320 points (64%) [See Course = Calendar=20 below for point breakdown]=20
Attendance/Participation =3D 80 points (16%)=20
Final Report =3D 100 points (20%)=20
TOTAL: 500 points (100%)

The = College=92s=20 standard numerical grading scale will be used for calculating final=20 grades:

A =20 A- B+ B B- = C+ =20 C C- D+ D D- F

93+ = 90 87 83 80 = 77 =20 73 70 67 63 60 59-

Academic=20 Honesty:

The Champlain College Student Handbook describes the = College's=20 Academic Honesty Policy. You should be familiar with that policy, which = states=20 simply that if you cheat, you get a 0 (zero). More importantly, in the = field of=20 forensics and law enforcement, there is quite simply no room for = dishonesty; it=20 can destroy a career instantaneously. For that reason, there is a = zero-tolerance=20 policy in this class for cheating, plagiarism, and other forms of = academic=20 dishonesty. If you have a problem, simply contact an instructor and we = will help=20 to the greatest extent possible. Also, don't wait until the last minute = to do=20 homework assignments; last-minute panic is the primary cause of people = making=20 poor decisions!

Students with=20 Disabilities:

If you = believe=20 that you have a disability requiring accommodations in this class, = please=20 contact Janine Allo in the Counseling = Department,=20 Office of Disability Services, as soon as possible. = After you=20 receive your accommodation form, please contact the instructor ASAP to = insure=20 all accommodations are implemented in a timely fashion. It is the student's = responsibility to=20 seek and secure accommodations prior to the start of a test or = project. Accommodations cannot be = provided until=20 you supply the instructor with a form from Janine

Contact: Janine Allo

Counseling Department, Office of Disability = Services

Office: Hauke 007

Phone: 802-865-5484

Email:jallo@champlain.edu
Course Calendar: See = the=20 Assignments Tool in WebCT for assignment availability and due date = information,=20 and assignment details.

Date

Week

Topic

Reading

Homework

9/2 = &=20 9/4

=20 1

Legal

B-Ch=20 2

Subpoena (25=20 pts) /2703 Letter (10 pts)

9/9 = &=20 9/11

Seizing=20 Media

B-Ch=20 4

S-Ch=20 2

Search Warrant=20 (25pts) /HW & SW VFT(20 pts)

9/16 = &=20 9/18

Imaging/Previewing

B-Ch=20 12

S- Ch = 9

Convert FTK=20 Image file to DD (20 pts)

9/23 = &=20 9/25

Report=20 Writing-1

B-Ch = 10=20 Appendix A, B, C

Reports-=20 template (20 pts)

9/30 = &=20 10/2

FTK

B-Ch=20 9

S-Ch=20 13

FTK = Case=20 Scenario =96 part 1 (30 pts)

10/7 = &=20 10/9

FTK, = RV,=20 PRTK

S- Ch = 6

FTK = Case=20 Scenario =96 part 2 (20 pts)

10/14 = follows a=20 Monday schedule due to October = break

10/16 = &=20 10/21

ProDiscover

S- Ch = 8

ProDiscover = scenario (20=20 pts)

10/23 = &=20 10/28

EnCase

S-Ch=20 10

EnCase = scenario (30=20 pts)

10/30 = &=20 11/4

Report=20 Writing-2

S- Ch = 11

Create program=20 reports (20 pts)

11/6 = &=20 11/11

File = Systems-1=20

S-Ch=20 4

Create Helix=20 and Penguin Sleuth CDs (20 pts)

11/13 = &=20 11/18

Helix/Penguin=20 Sleuth

B-Ch=20 11

Image = RAM using=20 Helix (20 pts)

11/20 = &=20 11/25

File = Systems-2=20

S-Ch=20 5

*See=20 below*

Bootable Helix=20 and Penguin Sleuth (20 pts)

10/27 = is=20 Thanksgiving Break

12/2 = &=20 12/4

Helix-RAM,=20 hiberfil.sys

B-Ch=20 6

Use = FTK to=20 compare image of RAM and hiberfil.sys file (20=20 pts)

12/9 = &=20 12/11

Linux = Forensics

B-Ch = 14,=20 15

Final = Report=20 (100 pts)

12/15

Exam = Week- Go=20 over final reports

* S =3D Steel, Windows Forensics; B =3D Brown, = Computer=20 Evidence