HSCJ210: Digital Forensics and Incident Response Spring Semester 2010 Traverse City: UC - Wednesdays 6:00pm - 8:50pm, 1/11/10 - 3/2/10 Big Rapids: BUS121 - Thursdays 6:00pm - 8:50pm, 1/11/10 - 3/2/10 Instructor: Jim Jones, Ph.D. Contact information: Office: IRC 222 (BR), UC Ferric office (TC) Phone: 231-944-8020 (cell), 231-591-3148 ( BR office) Email: JamesJones@ferris.edu Office Hours (1/11/10 - 2/26/10): Wednesdays 1:00pm - 2:00pm (Traverse City) Thursdays 3:00pm - 6:00pm (Big Rapids) and by appointment * Please include your name and course number in any communications with me. Required Text: EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide (with DVD) by Steve Bunting (ISBN:0470181451) Course Credits: 3 Course Prerequisites: HSCJ202 Course Description: Students survey the role of computer technology in digital forensics and the characteristics of an incident response plan and its implementation. Students will utilize several digital forensic tools and techniques for surveillance, gathering evidence, and reconstructing crime scenes. Ethics Statement: The technologies, situations and implications that comprise the field of digital forensics require the highest ethical and moral standing. As such, any personal lapse of this standing – whether it is a lapse in judgment or a well constructed scheme – may constitute grounds for dismissal from the course, the program, and Ferris State University. Additionally, there is potential for legal consequence that may include prosecution. Do not duplicate or continue to access any information that may be of a criminal nature, violates privacy, and/or conflicts with this Ethics Statement. Should you come across anything of this nature don’t hesitate to contact Dr. Jones immediately. Course Policies: This syllabus is tentative in nature and may be modified by the instructor at any time. Assignments must be submitted in RTF, DOC, DOCX, or PDF format by the due date to FerrisConnect. Late work will not be accepted unless warranted by a documented emergency. No projects or course work will be accepted after 3/2/10 unless prior arrangements have been made. Grades will be posted in FerrisConnect approximately 1 week after assignments are due. There will be no grade changes after the semester ends. Submitted work may be checked using SafeAssign or similar services. If you object to having your work submitted to such services, you must notify the instructor via email no later than 1/17/10. Attendance and participation in all class meetings is required. Students missing more than 1 week of course interaction will not pass the course. Extenuating circumstances or unforeseen events will be handled at the discretion of the instructor and arrangements should be made prior to the absence. To pass this course, all assignments must be the original work of the student or team. All references and use of external sources must be appropriately documented. Plagiarism will result in not passing the course. Students must have completed at least 75% of course material and a completion contract to receive an incomplete. Any student who feels s/he may need an accommodation based on the impact of a disability should contact the instructor privately to discuss your specific needs. Cell phones should be silenced during class meetings; breaks will be provided during which calls may be made. Use of a computer for a reasons not related to course activities may result in loss of points. The Instructor reserves the right to make modifications to the course or this syllabus to accommodate unforeseen circumstances. The dates and terms in this syllabus supersede any discrepancies from any other source. Learning Assessment Methods and Criteria: Student grades will be computed as follows: 7 Class Exercises @ 50 points each 350 5 Class quizzes @ 50 points each 250 1 Written final exam 250 1 Practical final exam 250 5 Weekly preparations @ 50 points each 250 5 weekly assignments @ 50 points each 250 7 class participations @ 10 points each 70 -----------------------------------------------------1670 points NOTE: Failure to complete and submit all of the assignments in a timely manner will be grounds for a failing grade. Assignments: Weekly assignments will be discussed each week in class and due dates are noted in FerrisConnect. Assigned work is to be your own individual effort unless otherwise noted. You may use external resources, but they must be appropriately documented. Schedule: Reading assignments are to be completed prior to the class listed. Quiz on reading assignments will be the first agenda item each week in class. A typical class session begins with a quiz on reading material, followed by a lecture over the current week’s material, followed by course activities. Grading Scale: A 1500 points A1450 B+ 1400 B 1350 B1300 C+ 1250 C 1200 C1150 D 1100 F below 1100 Course Outcomes and Assessment: Upon completing this course, students will be able to: 1. Identify and describe the role of computer technology in digital forensics. • Assessment: Objective testing, case study analysis, and/or project assessment. 2. Identify and describe the characteristics and implementation of an incidence response plan. • Assessment: Objective testing, case study analysis, and/or project assessment. 3. Identify and describe the capabilities of digital forensic tools. • Assessment: Objective testing, case study analysis, and/or project assessment. 4. Describe and utilize digital forensic tools for surveillance, gathering evidence and crime scene reconstruction. • Assessment: Objective testing, case study analysis, demonstration, and/or project assessment. Course Outline including Time Allocation: 1. The role of computer technology in digital forensics. (9 hours) • Overview of computer technology • The use of computer technology in computer crime • Crime scene procedures 2. Incidence response plan. (12 hours) • Components • Implementation techniques and procedures • Utilization 3. Digital forensic tools. (12 hours) • Types and capabilities • Procedures and protocols • Utilization 4. Surveillance, gathering evidence, crime scene reconstruction. (12 hours) • Integrating digital tools into the investigation process • What constitutes evidence • Preserving evidence Schedule