CFOR 210 Computer Forensics III

This course covers topics related to advanced concepts in computer forensics and cross-validating electronic case data analysis using popular software tools recognized in the computer forensics field. Students will examine electronic communications laws related to PDA's, cell phones, and laptop devices. Students will examine how PDA's, cell phones, and laptop devices operate and store electronic data, and will become familiar with the major manufacturers of these electronic storage devices. Students will develop basic computer forensic interview techniques and skills. Students will have hands-on laboratory experience using various computer forensic tools and prepare evidence.

Credits

3

Prerequisite

CFOR 200

Hours Weekly

2 hours lecture, 2 hours lab weekly

Course Objectives

1. 1. Become familiar with the components of the Encase forensic software environment, including the case,
   evidence and configuration files and how to acquire removable media and validate the image file
   created.
2. 2. Explore methods of data storage and forensic recovery, specifically the relevant forensic differences
   between the FAT, NTFS and CD files system, using Access Data Software.
   
3. 3. Do the cross-validation of computer forensic case data using Encase, Access Data and NTI forensic
   tools.
   
4. 4. Compare and contrast the strength and weaknesses of various computer forensic tools discussed in class.
5. 5. Prepare a basic computer forensic hardware and software platform needed to conduct computer forensic
   analysis in the laboratory.
   
6. 6. Examine electronic communications laws associated with PDA, cell phones and laptops.
7. 7. Examine the data acquisition procedures for cell phones, PDA and laptops.
8. 8. Describe the operation and electronic storage processes of PDA’s, cell phones and laptops.
9. 9. Develop basic computer forensic interviewing techniques and tactics.
   
10. 10. Research emerging topics related to computer forensics.

Course Objectives

1. 1. Become familiar with the components of the Encase forensic software environment, including the case,
   evidence and configuration files and how to acquire removable media and validate the image file
   created.
2. 2. Explore methods of data storage and forensic recovery, specifically the relevant forensic differences
   between the FAT, NTFS and CD files system, using Access Data Software.
   
3. 3. Do the cross-validation of computer forensic case data using Encase, Access Data and NTI forensic
   tools.
   
4. 4. Compare and contrast the strength and weaknesses of various computer forensic tools discussed in class.
5. 5. Prepare a basic computer forensic hardware and software platform needed to conduct computer forensic
   analysis in the laboratory.
   
6. 6. Examine electronic communications laws associated with PDA, cell phones and laptops.
7. 7. Examine the data acquisition procedures for cell phones, PDA and laptops.
8. 8. Describe the operation and electronic storage processes of PDA’s, cell phones and laptops.
9. 9. Develop basic computer forensic interviewing techniques and tactics.
   
10. 10. Research emerging topics related to computer forensics.