Course details

Digital Forensics (in English)

DFAa Acad. year 2024/2025 Summer semester 5 credits

Current academic year

The course focuses on the role of computer forensics and the methods used in the investigation of computer crimes. The course explains the need for proper investigation and illustrates the process of locating, handling, and processing computer evidence. A detailed explanation of how to efficiently manage a forensics investigation and how to preserve and present evidence is covered.

Guarantor

Ryšavý Ondřej, doc. Ing., Ph.D. (DIFS)

Course coordinator

Matoušek Petr, doc. Ing., Ph.D., M.A. (DIFS)

Language of instruction

English

Completion

Examination (written+oral)

Time span

  • 26 hrs lectures
  • 13 hrs laboratories
  • 13 hrs projects

Assessment points

  • 55 pts final exam
  • 30 pts numeric exercises
  • 15 pts projects

Department

Department of Information Systems (UIFS)

Lecturer

Ryšavý Ondřej, doc. Ing., Ph.D. (DIFS)

Instructor

Mutua Nelson Makau, M.Sc. (DIFS)
Ryšavý Ondřej, doc. Ing., Ph.D. (DIFS)

Learning objectives

The aim is to understand principles of computer forensics and the basic concepts used in a computer forensics examination; introduces techniques required for conducting a forensic analysis of systems and data.


Student acquaints basic concepts and principles of computer forensics and skills in a computer forensic examination.

Prerequisite knowledge and skills

Basic knowledge of operating systems, storage media, networks, and the ability to create simple programs.

Study literature

  • Nipun Jaswal: Hands-On Network Forensics: Investigate network attacks and find evidence using common network forensic tools,  Packt Publishing, 2019.
  • Bruce Nikkel , Practical Linux Forensics, No Starch Press, 2021

Fundamental literature

  • Daren Hayes, Practical Guide to Digital Forensics Investigations, Pearson IT Certification; 2nd edition, 2020.
  • Gerard Johansen: Digital Forensics and Incident Response: Incident response techniques and procedures to respond to modern cyber threats, Packt Publishing; 2nd edition, 2020

Syllabus of lectures

  1. Introduction to Forensic Investigation
  2. Forensic Data Acquisition
  3. Hands-on Lab: Forensic Data Acquisition and Analysis
  4. Computer Forensic Examination
  5. Hands-on lab: Web Browser Analysis
  6. Network Forensics
  7. Hands-on Lab: Network Forensics using Wireshark
  8. Traffic Tunneling, VPNs, and Covert Channels
  9. Hands-on Lab: Covert Channels Analysis
  10. Malware Forensics
  11. Hands-on Lab: Malware Forensics
  12. Password Recovery 
  13. Hands-on Lab: Password Recovery 

Syllabus of laboratory exercises

  1. Forensic Data Acquisition and Analysis
  2. Web Browser Analysis
  3. Network Forensics using Wireshark
  4. Covert Channels Analysis
  5. Malware Forensics
  6. Password Recovery 

Syllabus - others, projects and individual work of students

Performing the investigation of the selected cases. Solving the cases and writing the report.

Progress assessment

  • Project (15 points).
  • Hands-on labs (30 points). Missed labs can only be replaced if there is a serious obstacle in the study. 
  • Final exam (55 points). Minimum of 20 points of the final exam is necessary to pass the course.

 

Controlled activities include the project (15 points), hands-on labs (30 points), and the final exam (55 points). Missed labs can only be replaced if there is a serious obstacle in the study. 

How to contact the teacher

As part of face-to-face activities. Possibilities of individual consultations during the teacher's consultation hours or at other times by appointment.

Course inclusion in study plans

Back to top