Course details
Digital Forensics (in English)
DFAa Acad. year 2021/2022 Summer semester 5 credits
The course focuses on the role of computer forensics and the methods used in the investigation of computer crimes. The course explains the need for proper investigation and illustrates the process of locating, handling, and processing computer evidence. A detailed explanation of how to efficiently manage a forensics investigation and how to preserve and present evidence is covered.
Guarantor
Course coordinator
Language of instruction
Completion
Time span
- 26 hrs lectures
- 13 hrs laboratories
- 13 hrs projects
Assessment points
- 55 pts final exam (written part)
- 30 pts numeric exercises
- 15 pts projects
Department
Lecturer
Matoušek Petr, doc. Ing., Ph.D., M.A. (DIFS)
Mutua Nelson Makau, M.Sc. (DIFS)
Ryšavý Ondřej, doc. Ing., Ph.D. (DIFS)
Veselý Vladimír, Ing., Ph.D. (DIFS)
Instructor
Matoušek Petr, doc. Ing., Ph.D., M.A. (DIFS)
Mutua Nelson Makau, M.Sc. (DIFS)
Ryšavý Ondřej, doc. Ing., Ph.D. (DIFS)
Veselý Vladimír, Ing., Ph.D. (DIFS)
Subject specific learning outcomes and competences
Student acquaints basic concepts and principles of computer forensics and skills in a computer forensic examination.
Learning objectives
The aim is to understand principles of computer forensics and the basic concepts used in a computer forensics examination; introduces techniques required for conducting a forensic analysis of systems and data.
Why is the course taught
The course prepares students for the possible role of cyber attack investigator or forensic analyst within security teams.
Prerequisite knowledge and skills
Basic knowledge of operating systems, storage media, networks, and the ability to create simple programs.
Study literature
- Nipun Jaswal: Hands-On Network Forensics: Investigate network attacks and find evidence using common network forensic tools, Packt Publishing, 2019.
- Bruce Nikkel , Practical Linux Forensics, No Starch Press, 2021
Fundamental literature
- Daren Hayes, Practical Guide to Digital Forensics Investigations, Pearson IT Certification; 2nd edition, 2020.
- Gerard Johansen: Digital Forensics and Incident Response: Incident response techniques and procedures to respond to modern cyber threats, Packt Publishing; 2nd edition, 2020
Syllabus of lectures
- Introduction to Forensic Investigation
- Forensic Data Acquisition
- Hands-on Lab: Forensic Data Acquisition and Analysis
- Computer Forensic Examination
- Hands-on lab: Web Browser Analysis
- Network Forensics
- Hands-on Lab: Network Forensics using Wireshark
- Traffic Tunneling, VPNs, and Covert Channels
- Hands-on Lab: Covert Channels Analysis
- Malware Forensics
- Hands-on Lab: Malware Forensics
- Password Recovery
- Hands-on Lab: Password Recovery
Syllabus of laboratory exercises
- Forensic Data Acquisition and Analysis
- Web Browser Analysis
- Network Forensics using Wireshark
- Covert Channels Analysis
- Malware Forensics
- Password Recovery
Syllabus - others, projects and individual work of students
Performing the investigation of the selected cases. Solving the cases and writing the report.
Progress assessment
Evaluation of hands-on labs during the course. Final Exam at the end of the course.
Teaching methods and criteria
The course consists of lectures and related practical exercises. Practical exercises begin with a brief presentation of the problem. Then students have time to solve a problem in class. For each lab, students are expected to write a report and submit it. Writing and sending a report is a subsequent homework of each laboratory. The deadline for submitting the report is one week.
Controlled instruction
Controlled activities include the project, hands-on labs, and the final exam. Missed labs can only be replaced if there is a serious obstacle in the study.
Exam prerequisites
- Earning at least 20 points during the term is required.
- Minimum of 20 points of the final exam is necessary to pass the course.
How to contact the teacher
As part of face-to-face activities. Possibilities of individual consultations during the teacher's consultation hours or at other times by appointment.
Course inclusion in study plans
- Programme IT-MGR-2, field MBI, MBS, MGM, MIN, MIS, MMM, MPV, MSK, any year of study, Elective
- Programme IT-MGR-2 (in English), field MGMe, any year of study, Compulsory-Elective group I
- Programme MITAI, field NADE, NBIO, NCPS, NEMB, NGRI, NHPC, NIDE, NISD, NISY, NISY up to 2020/21, NMAL, NMAT, NNET, NSEC, NSEN, NSPE, NVER, NVIZ, any year of study, Elective