The course gives the student both practical and theoretical knowledge of technologies, methods, models, laws/rules that apply at investigations of digital crimes or incidents.
For example the course covers the following:
- The history of forensics
- Digital forensics and digital evidence
- The investigation process of forensics/incident response
- Legislation and international cooperations in digital forensics
- Standards in the area and the requirements of an organisation that works with digital forensics or incident management
- Computer forensics
- Forensics for embedded systems and mobile units
- Network forensics
After passing the course, the student should be able to:
- describe central concepts, models and methods in digital forensics and incident response
- describe the differences and similarities between a forensic situation and an incident response situation
- apply known methods for data collection and analysis in given situations
- plan and carry out data collection and data analysis for a forensic or incident analysis
- present and explain conclusions from a forensic analysis and an incident analysis and propose future actions
- explain the degree of certainty of the conclusions that can be drawn from a forensic analysis
- explain how one distinguishes between digital forensics and incident response
- critically review and source-critically assess a forensic report and an incident management report.
