HIBBING COMMUNITY COLLEGE
COURSE OUTLINE
COURSE TITLE & NUMBER: CNT 2170: Digital Forensics II
CREDITS: 3 (Lec 2/ Lab 1)
PREREQUISITES: CNT 2070 Digital Forensics I
CATALOG DESCRIPTION:
This course is a continuation of Digital Forensics I, and includes forensic analysis
of Linux file systems and introduces additional various forensic analysis software
suites used to perform forensic analysis of FAT16. FAT 32, and NTFS file
systems. This course will feature the use of Encase and FTK forensics tools.
OUTLINE OF MAJOR CONTENT AREAS:
I.
II.
III.
IV.
V.
VI.
VII.
VIII.
IX.
X.
XI.
XII.
XIII.
XIV.
Computer Forensics and Investigations as a Profession
Understanding Computer Investigations
The Investigators Office and Laboratory
Current Forensics Tools
Processing Crime and Incident Scenes
Digital Evidence Controls
Working with Windows and DOS Systems
Macintosh and Linux Boot Processes and File Systems
Data Acquisition
Computer Forensics Analysis
Recovering File Systems
Recovering Image Files
Network Forensics
Becoming an expert Witness and Reporting Results of Investigations
COURSE OUTCOMES/OBJECTIVES/GOALS:
The student will
1. gain an understanding of computer forensics.
2. explain maintaining professional conduct.
3. describe key terms.
4. prepare a computer investigation.
5. explain taking a systematic approach.
6. describe data-recovery workstations and software.
7. explain the gathering of evidence.
8. create a forensic boot CD/floppy disk.
9. determine the tools necessary for creating boot disks.
10. retrieve evidence data using a remote network connection.
11. analyze digital evidence.
12. explain the forensic labs certification requirements.
13. determine the physical layout of a computer forensics lab.
Hibbing Community College, a technical & community college
An equal opportunity educator & employer
14. explain the selection of a computer forensics workstation.
15. validate and test forensic software.
16. explain the concepts and terms used in warrants.
17. determine whether or not to seize a computer.
18. explain securing a computer incident or crime scene.
19. explain evidence rules.
20. describe processing and handling of digital evidence.
21. prepare documented evidence.
22. explain evidence retention and media storage.
23. describe digital hash.
24. explain boot sequences.
25. describe disk partitions, MBR, FAT and NTFS.
26. explain NTFS EFS, WIN9x Registry, WINXP Registry.
27. describe the Macintosh boot process, file system and boot tasks.
28. explain the Linux boot process and boot tasks.
29. describe CD data structures.
30. demonstrate the knowledge of SCSI, EIDE, IDE disks and devices.
31. determine the best acquisition method.
32. plan data recovery contingencies.
33. demonstrate various software recovery and acquisition tools and
techniques.
34. describe computer forensics analysis.
35. describe a basic forensic toolkit.
36. demonstrate password recovery techniques.
37. demonstrate the understanding of bitmaps, raster images, vector images
and metafile graphics.
38. explain lossless and lossy compression.
39. demonstrate the reconstruction of file fragments
40. demonstrate the use of steganalysis tools.
41. demonstrate the knowledge of internet protocols.
42. explain basic network principles.
43. describe network forensics and techniques.
44. explain the roles of the client and the server in e-mail.
45. identify e-mail crimes and violations.
46. demonstrate an understanding of email servers
47. describe special e-mail forensics tools.
48. explain the difference between different e-mail servers and operating
systems.
49. demonstrate understanding of the importance of detailed reports.
50. demonstrate the designing and layout of presentations and reports.
51. explain documenting and preparing of digital evidence.
HIBBING COMMUNITY COLLEGE COMPETENCIES MET:
Communicating clearly and effectively; Thinking Creatively and Critically
Hibbing Community College, a technical & community college
An equal opportunity educator & employer
STUDENT CONTRIBUTIONS:
The student will attend lectures regularly, participate in class discussions, and
spend sufficient time in the classroom and lab to complete all assignments and
examinations on a timely basis.
METHODS FOR EVALUATING STUDENT LEARNING:
The final grade is determined by grades earned on lab exams, written
assignments, periodic quizzes, attendance, and written examinations.
SPECIAL INFORMATION (SPECIAL FEES, DIRECTIVES ON HAZARDOUS
MATERIALS, TEXTBOOK USED, ETC.)
AASC APPROVAL DATE
REVIEW DATE
March 21, 2007
March 2012
Hibbing Community College, a technical & community college
An equal opportunity educator & employer