ClassInfo

CNS 450 Digital Forensic Techniques (Formerly CNS 450)

Corin Pitcher

Office: CDM 835
Fall 2007-2008
Class number: 11698
Section number: 701
W 5:45PM - 9:00PM
CDM 00218 Loop Campus

Summary

This course focuses on the forensic analysis of data from computer systems. This course covers: preservation and interpretation of evidence; file systems, e.g., FAT and NTFS; storage behavior of applications; forensic tools; tool development and automation; indexing documents; reporting and testimony. Optional topics include: anti forensics; data mining; data recovery; intrusion detection; software forensics.



Texts

Two required textbooks are required. File System Forensic Analysis; by Brian Carrier; Addison-Wesley; 2005; ISBN 0321268172. Real Digital Forensics: Computer Security and Incident Response; by Keith J. Jones, Richard Bejtlich, Curtis W. Rose; Addison-Wesley; 2006; ISBN 0321240693. One optional textbook, recommended for those without prior Linux experience: A Practical Guide to Linux Commands, Editors, and Shell Programming, by Sobell, Prentice Hall PTR, ISBN-13: 978-0-13-147823-7.


Grading

Your final grade will be based on:

Homework: 60%

Research project and presentation: 40% (distance-learning students can give their presentation from a remote location)

Homework assignments:

Involve elementary programming (Java recommended, C/Perl/Python acceptable for submission but no support guaranteed); file system and
application storage principles; use of VMWare Server and
Linux to both create and analyze forensic data; reporting
of analysis.

Homework assignments must be solved individually unless
explicitly stated otherwise. You must not use anyone
else's solution, and you must clearly acknowledge any code
that you obtain from other sources (such as books,
magazines, or the Internet). If you are in any doubt,
contact the instructor for advice. For the homework
assignments, you may use as much code as you like from the
examples discussed in class.

You are expected to complete all of the homework
assignments by the deadline. Late homework submissions
will not be accepted, and all homework assignments will
count towards the final grade.

Homework assignments must be submitted through the online
system unless stated otherwise. Email submissions will
not be accepted.


Prerequisites

(CSC 211 and CSC 212) or CSC 224 or equivalent Java experience; AND CSC373 or CSC383 or instructor consent.


System Requirements

A fast Internet connection. You will need to download
several GB.

An Intel PC host capable of running VMWare Server, so
will need Windows XP, Windows 2003, or Linux. You can
also use VMWare remote console to access your VMWare
Server from another machine if you wish.

Your VMWare host machine will need at least 20GB of free
space on a hard drive. If you need more storage space and
cannot fit another internal hard drive, an external USB
hard drive will be fine.

A DVD writer to burn the result of your assignment(s).


School policies:

Changes to Syllabus

This syllabus is subject to change as necessary during the quarter. If a change occurs, it will be thoroughly addressed during class, posted under Announcements in D2L and sent via email.

Online Course Evaluations

Evaluations are a way for students to provide valuable feedback regarding their instructor and the course. Detailed feedback will enable the instructor to continuously tailor teaching methods and course content to meet the learning goals of the course and the academic needs of the students. They are a requirement of the course and are key to continue to provide you with the highest quality of teaching. The evaluations are anonymous; the instructor and administration do not track who entered what responses. A program is used to check if the student completed the evaluations, but the evaluation is completely separate from the student’s identity. Since 100% participation is our goal, students are sent periodic reminders over three weeks. Students do not receive reminders once they complete the evaluation. Students complete the evaluation online in CampusConnect.

Academic Integrity and Plagiarism

This course will be subject to the university's academic integrity policy. More information can be found at http://academicintegrity.depaul.edu/ If you have any questions be sure to consult with your professor.

All students are expected to abide by the University's Academic Integrity Policy which prohibits cheating and other misconduct in student coursework. Publicly sharing or posting online any prior or current materials from this course (including exam questions or answers), is considered to be providing unauthorized assistance prohibited by the policy. Both students who share/post and students who access or use such materials are considered to be cheating under the Policy and will be subject to sanctions for violations of Academic Integrity.

Academic Policies

All students are required to manage their class schedules each term in accordance with the deadlines for enrolling and withdrawing as indicated in the University Academic Calendar. Information on enrollment, withdrawal, grading and incompletes can be found at http://www.cdm.depaul.edu/Current%20Students/Pages/PoliciesandProcedures.aspx.

Students with Disabilities

Students who feel they may need an accommodation based on the impact of a disability should contact the instructor privately to discuss their specific needs. All discussions will remain confidential.
To ensure that you receive the most appropriate accommodation based on your needs, contact the instructor as early as possible in the quarter (preferably within the first week of class), and make sure that you have contacted the Center for Students with Disabilities (CSD) at:
Lewis Center 1420, 25 East Jackson Blvd.
Phone number: (312)362-8002
Fax: (312)362-6544
TTY: (773)325.7296