Digital Forensics

The essentials covered in this course include computer system storage fundamentals, operating systems and data transmission, computer network architecture, digital forensic best practices, proper evidence collection and storage, and federal rules and criminal codes. Upon successful completion of this course, students are ready for advanced and technical courses in computer forensics, mobile device forensics and malicious code forensics.

This course builds on the concepts taught in Principles of Digital Forensics. Students are introduced to forensic software such as FTK, EEncase and a suite of free open-source software such as the Sleuth Kit, Autopsy, SANS SIFT and Kali. Students are also introduced to forensic hardware and learn how to properly image computer media in a forensically sound manner.

This course focuses on proactive and reactive digital security incident management. Students learn how data moves throughout a network and where digital evidence is most likely found on network hardware and software. A blend of technical lab work and lecture, this course prepares students to respond to both corporate incident response scenarios and criminal cases involving email, instant messaging, file downloads, malicious code, etc. It helps students realize the importance of preparing for cyberattacks and incident security incidents as well as how to best respond to and recover from such incidents. Students learn how to capture and analyze network traffic using Wireshank and Topdump whether attacks are piracy, fraud or espionage.

This course explores the collection, preservation and analysis of data from mobile devices such as cell phones, tablets and PDAs. The course expands on the principles of digital forensics, teaching students how to review data stored on mobile devices including phone calls, text, internet history, photos and videos. It teaches students how to acquire and analyze a forensically sound image of a wide range of mobile devices using a portfolio of forensic devices and software. This course primarily takes place in a lab setting, with the majority of coursework devoted to technical hands-on work and technical writing.

This course challenges students to think more systemically about the current threat landscape as it relates to insider threats. This course assists management, human services and information technology professionals with the prevention, detection and mitigation of risks associated with insider threats. Instructional methods include readings, written assignments, online discussion forums and virtual computer lab assignments.

Malware, also known as malicious software, can harm computers and networks. It can destroy and corrupt files leading to the exposure of sensitive information, loss of money and useless resources. This highly technical course explores the basics of malware code, including how malicious code is created and how it behaves on a host/network. Students use a virtual machine environment to safely run and reverse engineer real-world samples of malicious code, conduct static and dynamic code analysis, and incorporate their findings and analysis into technical forensic reports.

This course explores current topics not covered in regularly offered courses. Evolving technologies and contemporary trends in justice and homeland security law and practice create opportunities to present the most timely and important topics to students. Students may individualize their program of study to access special topics courses with permission from the program director. Recent topics have included the philosophy of police, strategic planning for law enforcement executives, community policing, organized crime, white collar crime, contemporary issues in undercover operations, police use of force and advanced community policing.