CS4677, Computer Forensics (3-2) -- Syllabus for Winter 2017


Catalog description


This course covers the fundamentals of computer forensics in the context of DoN/DoD information operations.  Students examine how information is stored and how it may be deliberately hidden and/or subverted.  Coverage includes: practical forensic examination and analysis, techniques of evidence recovery, legal preparation of evidence, common forensic tools, principles of original integrity, disk examination, and logging. Prerequisite: CS3600.




Prof. Neil Rowe, ncrowe@nps.edu, (831) 656-2462, GE-328 faculty.nps.edu/ncrowe.  No official office hours but he is usually there 900-1700.  Lab manager is Riqui Schwamm, x3990, GE-237.




Three homework assignments (including some lab exercises) and a class project.  Homework must be done by each student on their own without consulting anyone besides the instructor.  The project can be done in groups or individually.  The project topic must be something related to forensics that requires at least 20 hours of work, and will need to be approved by the instructor.  The penalty is 15% for assignments received after the due date.  Homework should be submitted as a single document with your name at the top of the document, all material for each problem together (no appendices), and without the text of the problems (just your answers).




The lab we will use is GE-B013, in the basement of Glasgow East.  We have a limited number of key cards.  Windows machines are available and you can use your NPS account to log in.  There are also two special workstations, one for imaging mobile devices, and one for imaging hard disks.  We will only use some of the scheduled lab hours with dates to be announced in class.


Textbook and materials


Required textbook is E. Casey Digital Evidence and Computer Crime, third edition, Academic Press, 2011.  This book focuses on nontechnical topics and will be supplemented by other more technical material in class to make this more of a graduate-level course.


Reading schedule


By 1/13: Read Chapters 1 and 2

By 1/23: Read Chapters 6 and 7

By 1/30: Read Chapter 15

By 2/6: Read Chapter 16

By 2/13: Read Chapter 17

By 2/20: Read Chapter 23

By 2/27: Read Chapter 3

By 3/7: Read Chapter 4

Project due 3/27





Topics covered in order:

·         Introduction: Analogies to and differences from traditional forensics

·         Forensic procedures: Analogies to procedures for criminal investigation

·         Basic concepts needed from computer science

·         Data collection: Different sources of forensic data

·         Forensic duplication: Important to do it carefully

·         File systems and file types: Analyzing structures

·         Text analysis: Searching for strings and counting patterns

·         Sleuthkit and Autopsy: Examples of standard forensic tools

·         File carving and personal artifacts: Finding useful data pieces and assembling them

·         Registry and times: Special kinds of useful bookkeeping, permit seeing patterns

·         Networking forensics: Network data, and constructing social networks from data

·         Deception in forensics: Enumerating the types encountered

·         Legal aspects of forensics: Privacy laws, expert testimony, reproducibility, special laws


Some ideas for the final project – these are just a start