Computer Forensics and Digital Investigation is a module designed to give students a detailed insight into the subject area dealing with acquisition, analysis and interpretation of digital evidence.
It covers both the practical and theoretical side of managing a digital investigation - legislation, seizure of evidence at the crime scene, the importance of maintaining a chain of custody are areas important to all disciplines of forensic science and are discussed with digital evidence in mind.
The module also covers the practical analysis of digital evidence, using industry recognised as well as open source tools to assist the investigator in revealing what has happened on a system. Particular areas covered include: evidence handling, analysing system information, cryptographic techniques assisting computer forensics, event timing, disk imaging and disk recovery.
Typically, there are four lectures and two tutorial/practical sessions each week. The assessment typically comprises of a large case study based coursework (70%) and an in-class test based on the taught content (30%).