Download CHESAPEAKE COLLEGE

CHESAPEAKE COLLEGE
Wye Mills, Maryland
CORE COURSE OF STUDY
Course Prefix and Number: CIS 262 Computer Forensics
Course Description (As currently shown in the Chesapeake College Catalog).
This course introduces students to the study of computer forensics. Students will explore computer-based
investigation methods necessary to properly conduct a computer forensics investigation. Areas of focus
include understanding computer investigations, working with different operating systems, identifying
and using current computer forensics tools, applying digital evidence controls, processing crime and
incident scenes, applying techniques for data acquisition, conducting E-mail investigations, recovering
image files, producing written investigation reports, and implementing procedures for corporate hightechnology investigations.
Statement of Course Goals:
1. Describe and apply computer forensics fundamentals.
2. Explain how computer investigations are conducted.
3. Use basic computer forensics technologies.
4. Use forensic software tools to access and recover evidence and conduct forensic analysis.
5. Relate the use of computer forensics to various crime and incident scenes.
Common Core Learning Outcomes: At the completion of this course, the student will be able to:
1. Effectively use data acquisition and computer forensics tools.
1. Identify, secure, catalog and store digital evidence
2. Describe and apply tools and techniques used in Internet investigations.
3. Prepare for and execute a computer forensics investigation
4. Describe how to secure a computer incident or crime scene
5. Apply knowledge of disk structures and boot tasks to solve a crime
6. Plan data recovery contingencies
7. List forensic lab certification requirements
8. Perform a computer forensics analysis
9. Explain data hiding techniques
10. Identify and investigate e-mail crimes and violations
11. Locate and recover image files
12. Compare technical and scientific testimony
13. Form an expert opinion
Common Course Outline of Material Included in the Course:
I. Computer Investigation.





Prepare for computing investigations
Begin an investigation
Execute an investigation
Complete a case
Critique a case
II. PC and Non-PC Operating Systems.



Describe different computer file systems
Describe Microsoft disk structures
List Microsoft boot tasks







Use the Microsoft Disk Operating System
Describe Macintosh disk structures
List Macintosh boot tasks
Describe UNIX and Linux disk structures
List UNIX and Linux boot processes
Create a forensic boot floppy disk
Retrieve evidence data using a remote network connection
III. Computer Forensics Tools.



Use command-line forensics tools
Use graphical user interface (GUI) forensics tools
Use computer forensics hardware tools
IV. Digital Evidence Controls.





Identify digital evidence
Secure digital evidence at an incident scene
Catalog digital evidence
Store digital evidence
Obtain a digital signature
V. Crime and Incident Scenes.







Process Private-Sector Incident Scenes
Process Law Enforcement Incident Scenes
Prepare for a search
Secure a computer incident or crime scene
Seize digital evidence at the scene
Collect digital evidence
Review a case
VI. Data Acquisition.






Determine the optimal data acquisition method
Plan data recovery contingencies
Use MS-DOS acquisition tools
Use Windows acquisition tools
Use GUI acquisition tools
Acquire data on Linux computers
VII. Computer Forensic Analysis.





Apply computer forensic analysis techniques
Use DriveSpy to analyze computer data
Use AcessData’s Forensic Toolkit (FTK)
Perform a computer forensic analysis
Explain data-hiding techniques
VIII. Internet Investigations.






List and describe fundamental Internet concepts
Define the roles of the client and server in e-mail applications
Identify e-mail crimes and violations
Investigate e-mail crimes and violations
Discuss how an e-mail server works
Use specialized e-mail computer forensics tools
IX. Investigation Reports.




List different types of reports
Plan a report
Limit a report to specifics
Write Clearly
X. Testifying.





Prepare for testimony
Describe how to testify in court
Describe how to handle cross-examinations
Prepare for a deposition
Form an expert opinion
Is this course included in the College’s General Education Program
Limited Distribution Core?
Yes
No
What are the specific General Education competencies addressed by this course?

_____________________________________________________________________________________________
Date Last Updated: 5/8/2017