Course manual 2022/2023
Course content
The following topics/subjects will be addressed:
Digital Forensics and cybercrime intro
Acquisition, Hashing/integrity
Live forensics/ memory forensics
(Smart)phone forensics
Embedded/Device forensics
Network forensics
Multimedia forensics
Big Data forensics
Objectives
- 1. Explain the theory and application of scientific principles and techniques involved in digital forensics.
- 2. Select, re-use, adapt and apply relevant computer science techniques to (parts of) a digital crime scene.
- 3. Analyse and organise a digital data set.
- 4. Generate alternative hypotheses and prioritize items of digital evidence.
- 5. Evaluate and judge the methods used in digital forensics investigation based on the appropriateness of the methods.
- 6. Independently conduct scientific research, to analyse and interpret the data, to draw critical conclusions based on the findings and to make recommendations for future work.
Teaching methods
- Lecture
- Presentation/symposium
- Self-study
- Computer lab session/practical training
Learning activities
Activity | Hours |
Hoorcollege | 26 |
Presentatie | 8 |
Werkcollege | 52 |
Self study | 82 |
Total | 168 | (6 EC x 28 uur) |
Attendance
This programme does not have requirements concerning attendance (OER part B).
Additional requirements for this course:
It is presupposed that all students will be present in class.
Assessment
| Item and weight
|
Details
|
|
| |
|
| Must be ≥ 5.5 |
|
| Must be ≥ 5.5 |
All components will be graded on a scale of 1-10. In order to pass the course, all components and the final grade have to be sufficient, i.e. at least a five and a half. When a student has not fulfilled this requirement, the examiner will register the mark ‘did not fulfill all requirements’ (NAV) whether or not the averaged grade is sufficient. The components will be weighted as follows:
1. report (70%)
2. presentation (30%)
The students will work in groups on the project.
| LO |
Tested in component |
EQ 1 |
EQ 2 |
EQ 3 |
EQ 4 |
EQ 5 |
EQ 6 |
EQ 7 |
EQ 8 |
EQ 9 |
EQ 10 |
| 1 |
1, 2 |
|
x |
|
|
|
|
|
|
|
|
| 2 |
1, 2 |
|
x |
|
|
|
|
|
|
|
|
| 3 |
1, 2 |
|
x |
|
|
|
|
|
|
|
|
| 4 |
1, 2 |
|
|
x |
|
|
|
|
|
|
|
| 5 |
1, 2 |
|
x |
|
|
|
|
|
|
|
|
| 6 |
1, 2 |
|
|
|
x |
|
|
|
|
|
|
Table of specification: the relation between the Learning Outcomes (LO) of the course, the assessment components of the course and the Exit Qualifications (EQ) of the Master’s Forensic Science (described in the Introduction in the Course Catalogue)
Fraud and plagiarism
The 'Regulations governing fraud and plagiarism for UvA students' applies to this course. This will be monitored carefully. Upon suspicion of fraud or plagiarism the Examinations Board of the programme will be informed. For the 'Regulations governing fraud and plagiarism for UvA students' see: www.student.uva.nl
Course structure
| Weeknummer | Onderwerpen | Studiestof |
| 1 | | |
| 2 | | |
| 3 | | |
| 4 | | |
| 5 | | |
| 6 | | |
| 7 | | |
| 8 | | |
The schedule for this course is published on DataNose.
In order to provide students some insight how we use the feedback of student evaluations to enhance the quality of edcucation, we decided to include the table below in all course guides.
| Cybercrime, digital traces and forensic data analysis (6EC) |
N=22 |
|
Strengths
- Hard drive removal lab
- Diversity of lectures (faraday cages / guest lectures) and teacher’s enthusiasm
- NFI visit (but on the other hand the NFI visit was experience too challenging for the non IT, AI, and computer science (CS) students)
|
Notes for improvement
- Lectures were too complex and too challenging for non IT/computer science students.
- No replies from staff for feedback, they often replied only after a couple of weeks. Attitude of one teacher was not much appreciated, especially in a lecture where students were having difficulties downloading software and students were told just to google it.
- Project presentation: lack of guidance and time constraint
|
Response lecturer:
-
- Teachers were again very impressed with the outcomes of the group projects. Students are able to come up with creative research questions, innovative ideas and forensic relevant results even though the main topics of the course are for the majority of the students not in their background.
- If possible groups indeed consist of at least one AI / CS / IT student. During dedicated project hours there was always a teacher available. Teachers also answered email from students in the evening and during weekends, but some could have slipped through. However, two aspects play an important role here. First, we expect a level of self-direction from the students. So a first answer can very well be to google it. In the end, teachers make sure that students can continue. Second, students come up with very creative plans, but that also means that the necessary equipment or programmes are not always readily or instantly available, even though teachers try very hard for this.
- This year, there was already more focus on the why (forensic relevance) of methods used, but in order to understand the why students also need to have a basic understanding of the how (digital part). This understanding is also important for the execution of their own project during the course, so the how can not be taken out of course.
- In addition, the lectures are not totally separate from the project. Because of the different topics students choose the direct applicability of a particular lecture to a particular topic differs between the groups. It is up to the students to deduce what they can apply to their project. Again this is part of the self-direction and the ability of students to think abstractly, e.g. to transfer the content of the lectures to their own project when appropriate.
- Giving a template and leading instructions for the presentation would diminish the amount of creativity and self-direction, which is very important for the course and the assignment. The time constraint is there to make sure all groups receive the same amount of time and that all presentation fit in one day. Time constraints are also very normal at big conferences.
|
Coordinator