Digital Forensics and Incident Response

Aim

The course covers the basic requirements, methodologies, and limitations of digital forensics and incident response, including techniques for identifying, securing, and evaluating digital evidence in various systems.

After completing the course, the student is expected to:

• Comprehend and explain the fundamental theories and principles of digital forensics and incident response.
• Comprehend and describe methodologies, challenges, and tools used in digital forensics and incident response across various systems.
• Implement, evaluate and document forensic investigations by interpreting digital evidence and utilizing forensic tools.

Content

During the course the following subjects will be included:

• Network forensics
• Incident response
• Digital forensics on hardware
• Mobile forensics
• Memory forensics
• Forensics on image and video
• Log management, preserving evidence
• Particulars of SCADA environments and critical infrastructure
• Theoretical models
• Advanced and narrow topics, e.g., adversary simulation
• Laws and use of digital forensic material as evidence