Digital evidence features in almost every part of our personal and business lives. Legal and business decisions hinge on timely data about what people have done. This module helps you understand how to conduct investigations to gather, analyse and present digital evidence to business and legal audiences. You’ll also learn how to find tools to locate and analyse digital evidence on various devices, including mobile phones, and how to keep up to date with changing technologies, laws and regulations in digital forensics.
What you will study
This online module provides a broad and practical introduction to the fundamentals of digital forensics. It begins by setting the context of digital forensics in the wider discipline of traditional forensic science to show how many of the principles and techniques still apply, including investigation skills, evidence handling, note taking and reporting. You will then take a detailed look at some of the English civil and criminal laws particularly relevant to digital forensic investigations and learn how to find the law, both in England and Wales and other jurisdictions. Using written material and videos, you will learn the principles of legal report writing and giving oral testimony.
We look at the architectures of the digital systems that are likely to require examination and teach the principles that allow you to identify the relevant architectures of new and evolving devices. You will learn to find and use both open source and commercial digital forensic tools to acquire and analyse digital evidence by doing practical exercises. Using written material and videos, you will develop competence as first responders to a digital forensic incident. The teaching will then expose you to the challenges of network forensics in a client-server network, virtualisation, and network traffic analysis.
Mobile devices, such as phones and tablets, are an important part of our everyday lives and therefore important sources of evidence in many forensic investigations. Through videos and practical exercises, you will develop the skills to conduct a forensic examination of a mobile device and be able to apply these to new devices as they are released. A number of advanced topics will be introduced including Internet Intelligence and malware analysis. The module concludes by helping you consolidate the concepts and skills you have learned to help an organisation prepare appropriate plans for forensic incidents.
You will learn
This module is particularly relevant for students wishing to begin a career in digital forensics. It was designed to match the learning outcomes for the Chartered Society of Forensic Sciences (CSFS) accreditation standards for digital forensics and some of the qualifications requiring M812 are recognised by the CSFS.
Vocational relevance
This module is appropriate if you are a computing student wanting to gain a further understanding of how digital forensics can be applied in both legal and business environments. It is appropriate if you want to enhance your career options in computer security or digital forensics.
Entry
It is expected that you will hold a bachelors degree (or equivalent) in computing or a related discipline, or alternatively have at least three years relevant industry experience.
Your spoken and written English must be of an adequate standard for postgraduate study. If English is not your first language, we recommend that you will need a minimum overall score of 6 and minimum score of 5.5 in each of the four components: reading, writing, speaking and listening under the International English Language Testing System (IELTS). Please see the IELTS website for details.
If you have any doubt about the suitability of the module, please speak to an adviser.
Preparatory work
You would benefit from some experience of using:
- more than one operating system – Linux in particular
- programs with a command line interface
- a virtual machine through software such as Oracle VirtualBox or VMware.
If you have a disability
The study material is online, so you’ll spend considerable time using a computer and the internet.
Some components might not be fully accessible using a screen reader. Mathematical and scientific materials can be particularly difficult to read in this way.
Written transcripts of audio components, figure descriptions and printable versions of texts are available.
If you’re using printed materials as part of reasonable adjustments to support your studies, note that printed versions of online materials are unavailable for this module.
To find out more about what kind of support and adjustments might be available, contact us or visit our disability support pages.
Study materials
What's included
This module is presented online. All study materials will be available on the module website, including:
- details of how to download and install VirtualBox and a current forensic investigation application
- four blocks of core texts
- access to module books available at the library
- module assessment
- exercises, YouTube videos and podcasts to support the teaching.
You will need
Having a second computer and mobile phone, possibly old or obsolete, may be useful for conducting forensic examination exercises.
Your computer will require a camera and microphone in order to complete the oral assessment as part of your final assignment (TMA).