Introduction to Computer Forensics

Course Syllabus – Spring 2008

 

 

 

Course Information

 

Instructor:       Mike Jochen

Phone:             570.422.3036

Email:               mjochen@po-box.esu.edu

Office:               310D Stroud Hall

Office Hours:  Tu 2:00 –  4:00 p.m.
                           W 2:30 – 3:30 p.m.
                           Th 12:30 – 2:30 p.m.

                           and by appointment

Course Number:      CPSC327 Y210

Class Time/Place:    W, 4 – 7 p.m.

                                      304 Stroud Hall

Semester Hours:      3

 

Resources:

 

Text: John R. Vacca. Computer Forensics: Computer Crime Scene Investigation, 2nd  Edition. Charles River Media. 2005.

 

Software:

 

Class Web Page: http://www.esu.edu/~mjochen/Teaching/CPSC327/s08/

 

WebCT

 

Course Overview:

 

This course will provide a foundation in the field of Computer Forensics.  The student will learn how to obtain and analyze digital information for possible use as evidence in civil, criminal or administrative cases.  Topics include applications of hardware and software to computer forensics, computer forensics law, volume and file system analysis, computer forensics investigations, and computer forensics in the laboratory.   Hands-on exercises guide discussions and reinforce the subject matter.  Prerequisite: CPSC 325.

 

Course Objectives:

 

By the end of the course, you will be able to:

1.   Correctly define and cite appropriate instances for the application of computer forensics

2.   Correctly collect and analyze computer forensic evidence

3.   Identify the essential and up-to-date concepts, algorithms, protocols, tools, and methodology of Computer Forensics

 

Instructional Approach:

 

I encourage an open dialogue during class and view my role as that of a facilitator toward your gaining a deeper understanding of the course material. We will utilize an active learning based style for the class, with the following techniques:

  1. Small group discussion and problem solving
  2. In-class question and answer sessions
  3. Practical exercises (in-class and homework)
  4. Quizzes (announced and unannounced)
  5. Student Oral Presentations
  6. Exams

Schedule:

 

The schedule for the class will be posted online and is subject to change. Please refer to the class calendar frequently.

 

Week

Dates

Topic

Reading

Activity

1

16-Jan

Intro/Overview

Chpt 1

Syllabus

2

23-Jan

Types of Forensics
Technology

Chpt 2

3

30-Jan

Types of Forensics
Systems

Chpt 3

Quiz

4

6-Feb

Forensics Services

Chpt 4

5

13-Feb

Data Recovery,
Collection, & Seizure

Chpt 5 - 6

Quiz

7

27-Feb

Evidence Duplication,
Preservation, & Verification

Chpt 7 - 8

Quiz
(Switch Day 2/20)

8

5-Mar

Evidence Discovery
& Identification

Chpt 9 - 10

Mid-term exam

9

19-Mar

Rconstructing Past
Event & Networks

Chpt 11 - 12

(Spring Break 3/10-14)

10

26-Mar

Information Warfare
Countermeasures

Chpt 13

Quiz

11

2-Apr

Future of Information
Warfare

Chpt 17

12

9-Apr

Chpt 18

Quiz

13

16-Apr

Chpt 19

14

23-Apr

Advanced Forensics

Chpt 20

Quiz

15

30-Apr

Oral Presentations
(Last Day of Classes: 5/2)

Final Exam

 

Requirements:

 

The following work will be required of you throughout the semester:

  1. Practical exercises (both in class and homework)
  2. Oral presentation
  3. Quizzes
  4. Exams

 

Each week, you will have reading and problems to complete.

 

During the semester you will have the opportunity to take several quizzes (some announced, some unannounced).

 

There will be two exams in this course – one mid-term exam and one final exam.

 

At the end of the semester, you will present a report on a computer forensics related topic, approved by the instructor.

 

Grading:

 

All work is due at the time and day specified when the assignment is given. Class-work and homework will be assigned and submitted for evaluation via WebCT.

 

If you miss a class where a quiz was given, you will be given a score of zero for that quiz. You will be allowed to drop your lowest quiz grade when it comes time for the final grade. So in this case you will be able to drop a zero for a missed quiz. For more information, see the section on class attendance below.

 

All exams count towards your final grade. No exam grades will be dropped. If you miss an exam the day an exam is given, you will receive a grade of zero for that exam, unless you made prior arrangements with me to make up the exam. “Prior arrangements” does not include coming to me the day of or after an exam. “Prior arrangements” means coming to me well before the exam date to make arrangements for an excused absence on exam day.

 

The make-up of your total number of points for your final grade breaks down as follows:

 

            10% Class participation

10% Quizzes (announced and unannounced)

20% Assignments

20% Presentation

20% Mid-Term Exam

20% Final Exam

 

Grading Policy:

 

I frequently feel that all too often, we artificially focus on the end of term grade rather than the content of a course. Nothing would please me more than to have a class full of students concerned solely with course material. I do realize however, that the pressure to maintain good grades for scholarships, awards, and applications for jobs and schools does indeed cause one to pay some attention to the end of term grade. A grade is the application of some arbitrary scale to reflect the amount and quality of work you, the student, accomplish during the semester. To that end, I do not assign your grade, you earn your grade.

 

The grading scheme for each assignment will be provided to you at the time the assignment is given. In this way, you will know exactly what I am looking for in terms of quality, focus, depth, and breadth of work. I do not believe in hidden agendas or surprising you with your grade on an assignment.

 

Rather than grading on a competitive, curve-based grading scheme, I use a criterion-based grade scale. Thus, if every student works sufficiently hard, and earns a letter grade of “A”, then all students will receive “A”s. Keep in mind, I generally view letter grades in the following light:

 

            A – Excellent

            B – Good

            C – Fair

            D – Poor

            E – Failure

 

This means, to receive an “A”, you must perform excellent work. Excellent work is that work which is marked with distinction, going above and beyond that of merely meeting the requirements for an assignment. Your final grades will be decided based on the following scale:

 

            A         90.0-100%

B         80.0-89.9%

            C         70.0-79.9%

            D         60.0-69.9%

            E         0-59.9%

 

Assignment Lateness Policy:

 

I strongly encourage you to keep up with the pace of the class and all associated work. Getting into the habit of turning in work after the due date will put you at a distinct disadvantage in learning the material. However, I do recognize that unforeseen events happen in life and I will accept late assignments with the following provisions: For each day late (n being the number of days late), you lose 2n points on your assignment. For example, if you turn in an assignment one day late, you will lose 21 or 2 points, two days late will cost 22 or 4 points, three days late will cost 23 or 8 points. In essence, the number of points deducted for lateness doubles each day. Late assignments will not be accepted after the sixth late day. Weekends and holidays count as late days.

 

Class Attendance/Participation Policy:

 

Class attendance is required. As such, attendance will be taken each class. If you are absent for three or more unexcused absences, you will receive a final grade of E (failure) for the class. I expect you to participate constructively in each class. When you fail to come to class, not only do you miss out on the material for the day, but you disadvantage your fellow students as your unique perspective is absent from class discussion and problem sessions.

 

If you are absent the day a quiz is given or an assignment is due, you will receive a grade of zero for the quiz or incur one day late for the assignment. If you know you must miss a class, please speak with me ahead of time so that we can try to make a mutually beneficial arrangement.

 

Academic Honesty Policy:

 

All work submitted is to be completed individually (unless indicated as a group assignment), and is to be the sole product of your own efforts. Group work is to be the sole product of members of the group. Any perception of anything to the contrary or that violates the spirit of the Student Code of Conduct will be handled accordingly. This policy is very specific on what constitutes Academic Misconduct and provides a range of very unpleasant possible outcomes, should a violation be suspected. I encourage you to become familiar with this policy. Please refer to the relevant sections of the Student Code of Conduct for more information.)

 

 

Ten Tips for Success:

 

1.      Come to class & arrive on time

2.      Actively participate in class discussion & activities

3.      Do the assigned reading

4.      Do the assigned homework/projects

5.      Review your notes/assignments daily

6.      Ask questions when you are unsure of something

7.      Ask questions when you would like to know more about something

8.      Accept points of view that differ from your own

9.      Respect the other members of your class

10.   Come see me as soon as you have difficulty with any of the material we cover in class

 

Statement of Understanding

CPSC 327

Spring 2008

 

By signing below, I indicate that I have read and understand all policies and provisions described in this syllabus. I further indicate that I have familiarized myself with the Student Code of Conduct and that I will abide by this code.

 

 

 

 

___________________________________________       _______________________

Printed Name                                                                               Date

 

 

 

 

Signature