This course introduces students to the core principles and practices involved in investigating digital assets (e.g., mobile phones, laptops, workstations) and cyber incidents. By examining methods for collecting, preserving, analysing, and presenting digital evidence, students will gain a practical understanding of forensic tools and techniques (e.g., FTK Imager, Autopsy, EnCase). Topics include chain of custody, evidence handling, imaging, file system analysis, investigations, and the use of industry-standard forensic software. Upon completing this course, students will be better prepared to conduct thorough, methodical examinations of digital devices and networks in support of security investigations.
Prerequisite Courses