CS-457.1: Digital Forensics (Spring 2022)

The aim of this course is to present and discuss methods, techniques, current best practices and standards commonly followed during the investigation of cases involving digital devices, including mobile phones. The course elaborates on how to handle devices and evidence at the crime scene, how to acquire artifacts from digital devices, how to preserve the integrity of the extractions, how to utilize open source and commercial forensic tools for analyis, how to verify the evidence presented by tools, how to write reports and how an investigator should properly testify in court. In this course, students will learn how to use forensic tools to extract and analyze digital evidence in order to conduct an efficient and high-quality investigation. This will include tools to circumvent security hardening, to acquire more information from challenging devices, to decode, and analyze the artifacts pertinent for any criminal investigation. Finally, this course discusses managerial as well as legal and ethical aspects applicable to digital forensics.

Learning Objectives

• Describe basic principles of digital forensics and identify the unique challenges involved in mobile forensics.
• Handle the crime scene based on the context and utilize the appropriate best practices, standards and legal provisions.
• Explain and compare various data acquisition and analysis techniques used in digital forensics.
• Explain and compare the internals of Android platforms such as OS architectures and file systems and learn how to circumvent device security hardening.
• Utilize open source and commercial forensics tools.
• Evaluate the evidential value of a digital artefacts and understand the importance of proper evidence handling.
• Document an investigation and properly present evidence to a court of justice.
• Appreciate and comply to applicable legal and ethical provisions.

The final grade is calculated as follows:

• 45% Assignments:
  • 30% 3 Assignments (equally weighted)
  • 15% Project
• 55% Written exams (best case):
  • 15% midterm + 40% final
  • 55% final
• 10% Capture-the-Flag (CTF) contest (bonus)

Instructor: Dr. Harry Manifavas

Lectures: Mon - Wed 14:00-16:00

Lab Hours: Fr 18:00-20:00 (You will be notified via email)

Location: H204

Course Area: Software Systems and Applications (E5)

Course Credits: 6 ECTS

Prerequisites:

• CS-345: Operating Systems
• Knowledge of computer security aspects is desirable, but not necessary.

Related courses: CS-457: Introduction to Information Security Systems

• CS457 discusses computer and network security topics.
• CS457-1 specifically deals with digital forensics

Course staff	Email	Office	Office Hours
Instructor: Dr. Harry Manifavas	harryman [at] ics.forth.gr	TBA	TBA
Teaching Assistant: Basha Skerdi	sbash [at] csd.uoc.gr	B210	TBA
Teaching Assistant: Kalochristianakis Dionisis	dionkal [at] csd.uoc.gr	B210	TBA