To introduce students to data forensics meaning the acquisition, investigation, analysis and reporting of data retrieved from usually digital devices for the purpose of finding evidence, recovering data or reconstructing events, in different scenarios from accidental data loss to possible criminal acts. The student's understanding will be based in a foundation of the structure of physical storage and the data storage systems built thereon, most typically file systems, and will include learning about and/or using tools used for forensic data acquisition, investigation and analysis.

[Data Forensics]: Definition; Evolution of Data Forensics; Need for Data Forensics in the digital age. [Physical Storage Foundations]: Introduction to storage media; storage hierarchy; types of physical storage; organisation of physical storage: hard disk, solid state; aspects of life cycle, durability, read/write/deletion and relevance to forensics. [Abstract Storage Principles]: Abstract structures for large scale data storage: volumes; concatenation; partitioning; RAID configurations; disk spanning; introduction to object storage and cloud storage. [File system foundations]: File systems design principles; Disk Partitioning and Partition Tables; Review of relevant features of real world file systems covering both Linux-type and Windows files systems (e.g., FAT, NTFS). [Forensic Investigation Principles and Procedures]: protocols, first response, chain of custody, documenting/reporting; examples of tools and approaches to volatile data acquisition and analysis, nonvolatile data acquisition and analysis; data carving; [Forensic Analysis Tools]: Laboratory/project based learning: storage acquisition tools, file system analysis tools; investigate one or more case study forensic problems with emphasis on the use of available tools.

On successful completion of this module, students will: 1. Demonstrate an understanding of and explain the role of data forensic investigators. 2. Explain and apply correct procedures to forensic investigation. 3. Explain how files are organised and tracked in a modern file system with an emphasis on security aspects. 4. Describe how data and computer usage patterns can be retrieved from digital evidence from devices. 5. Use forensic tools and commands to manage data recovery and analysis for the purpose of gathering digital evidence without damaging it.

na

na

The module is taught by lecture and tutorial for developing an understanding of storage and file systems. The usage of forensic tools is taught in the laboratory with the students using the tools to work with, for example, provided case studies.