HSCJ210: Digital Forensics and Incident Response
Spring Semester 2010
Traverse City: UC - Wednesdays 6:00pm - 8:50pm, 1/11/10 - 3/2/10
Big Rapids: BUS121 - Thursdays 6:00pm - 8:50pm, 1/11/10 - 3/2/10
Instructor: Jim Jones, Ph.D.
Contact information:
Office: IRC 222 (BR), UC Ferric office (TC)
Phone: 231-944-8020 (cell), 231-591-3148 ( BR office)
Email: JamesJones@ferris.edu
Office Hours (1/11/10 - 2/26/10):
Wednesdays 1:00pm - 2:00pm (Traverse City)
Thursdays 3:00pm - 6:00pm (Big Rapids)
and by appointment
* Please include your name and course number in any communications with me.
Required Text: EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide
(with DVD) by Steve Bunting (ISBN:0470181451)
Course Credits: 3
Course Prerequisites: HSCJ202
Course Description: Students survey the role of computer technology in digital forensics and the
characteristics of an incident response plan and its implementation. Students will utilize several digital
forensic tools and techniques for surveillance, gathering evidence, and reconstructing crime scenes.
Ethics Statement: The technologies, situations and implications that comprise the field of digital
forensics require the highest ethical and moral standing. As such, any personal lapse of this standing –
whether it is a lapse in judgment or a well constructed scheme – may constitute grounds for dismissal
from the course, the program, and Ferris State University. Additionally, there is potential for legal
consequence that may include prosecution. Do not duplicate or continue to access any information that
may be of a criminal nature, violates privacy, and/or conflicts with this Ethics Statement. Should you
come across anything of this nature don’t hesitate to contact Dr. Jones immediately.
Course Policies: This syllabus is tentative in nature and may be modified by the instructor at any time.
Assignments must be submitted in RTF, DOC, DOCX, or PDF format by the due date to FerrisConnect.
Late work will not be accepted unless warranted by a documented emergency. No projects or course
work will be accepted after 3/2/10 unless prior arrangements have been made. Grades will be posted in
FerrisConnect approximately 1 week after assignments are due. There will be no grade changes after the
semester ends. Submitted work may be checked using SafeAssign or similar services. If you object to
having your work submitted to such services, you must notify the instructor via email no later than
1/17/10. Attendance and participation in all class meetings is required. Students missing more than 1
week of course interaction will not pass the course. Extenuating circumstances or unforeseen events will
be handled at the discretion of the instructor and arrangements should be made prior to the absence. To
pass this course, all assignments must be the original work of the student or team. All references and use
of external sources must be appropriately documented. Plagiarism will result in not passing the course.
Students must have completed at least 75% of course material and a completion contract to receive an
incomplete. Any student who feels s/he may need an accommodation based on the impact of a disability
should contact the instructor privately to discuss your specific needs. Cell phones should be silenced
during class meetings; breaks will be provided during which calls may be made. Use of a computer for a
reasons not related to course activities may result in loss of points. The Instructor reserves the right to
make modifications to the course or this syllabus to accommodate unforeseen circumstances. The dates
and terms in this syllabus supersede any discrepancies from any other source.
Learning Assessment Methods and Criteria: Student grades will be computed as follows:
7 Class Exercises @ 50 points each
350
5 Class quizzes @ 50 points each
250
1 Written final exam
250
1 Practical final exam
250
5 Weekly preparations @ 50 points each
250
5 weekly assignments @ 50 points each
250
7 class participations @ 10 points each
70
-----------------------------------------------------1670 points
NOTE: Failure to complete and submit all of the assignments in a timely manner will be grounds for a
failing grade.
Assignments:
Weekly assignments will be discussed each week in class and due dates are noted in FerrisConnect.
Assigned work is to be your own individual effort unless otherwise noted. You may use external
resources, but they must be appropriately documented.
Schedule:
Reading assignments are to be completed prior to the class listed. Quiz on reading assignments will be
the first agenda item each week in class. A typical class session begins with a quiz on reading material,
followed by a lecture over the current week’s material, followed by course activities.
Grading Scale:
A
1500 points
A1450
B+
1400
B
1350
B1300
C+
1250
C
1200
C1150
D
1100
F
below 1100
Course Outcomes and Assessment:
Upon completing this course, students will be able to:
1. Identify and describe the role of computer technology in digital forensics.
• Assessment: Objective testing, case study analysis, and/or project
assessment.
2. Identify and describe the characteristics and implementation of an incidence
response plan.
• Assessment: Objective testing, case study analysis, and/or project
assessment.
3. Identify and describe the capabilities of digital forensic tools.
• Assessment: Objective testing, case study analysis, and/or project
assessment.
4. Describe and utilize digital forensic tools for surveillance, gathering evidence and
crime scene reconstruction.
• Assessment: Objective testing, case study analysis, demonstration,
and/or project assessment.
Course Outline including Time Allocation:
1. The role of computer technology in digital forensics. (9 hours)
• Overview of computer technology
• The use of computer technology in computer crime
• Crime scene procedures
2. Incidence response plan. (12 hours)
• Components
• Implementation techniques and procedures
• Utilization
3. Digital forensic tools. (12 hours)
• Types and capabilities
• Procedures and protocols
• Utilization
4. Surveillance, gathering evidence, crime scene reconstruction. (12 hours)
• Integrating digital tools into the investigation process
• What constitutes evidence
• Preserving evidence
Schedule