Course manual 2020/2021

Course content

The following topics/subjects will be addressed:

Digital Forensics and cybercrime intro
Acquisition, Hashing/integrity
Live forensics/ memory forensics
(Smart)phone forensics
Embedded/Device forensics
Network forensics
Multimedia forensics
Big Data forensics

Objectives

1. evaluate the theory and application of scientific principles and techniques involved in digital forensics.
2. select, re-use, adapt and apply relevant computer science techniques to (parts of) a digital crime scene
3. analyse and organise a digital data set
4. Generate alternative hypotheses and prioritize items of digital evidence
5. Judge the methods used in digital forensics investigation based on the appropriateness of the methods and explain the scientific basis of those methods.
6. Evaluate the strengths and weaknesses of digital forensic techniques

Teaching methods

Lecture
Presentation/symposium
Self-study
Computer lab session/practical training

Learning activities

Activity	Hours
Hoorcollege	26
Presentatie	8
Werkcollege	52
Self study	82
Total	168	(6 EC x 28 uur)

Attendance

This programme does not have requirements concerning attendance (OER part B).

Additional requirements for this course:

It is presupposed that all students will be present in class.

Assessment

Item and weight	Details
Final grade
70% Report	Must be ≥ 5.5, Mandatory
30% Presentation	Must be ≥ 5.5, Mandatory

All components will be graded on a scale of 1-10. In order to pass the course, all components and the final grade have to be sufficient, i.e. at least a five and a half. When a student has not fulfilled this requirement, the examiner will register the mark ‘did not fulfill all requirements’ (NAV) whether or not the averaged grade is sufficient. The components will be weighted as follows:

1. report (70%)
2. presentation (30%)

The students will work in groups on the project.

LO	Tested in component	EQ 1	EQ 2	EQ 3	EQ 4	EQ 5	EQ 6	EQ 7	EQ 8	EQ 9	EQ 10
1	1, 2		x					x
2	1, 2				x
3	1, 2					x
4	1, 2				x
5	1, 2				x				x
6	1, 2		x					x

Table of specification: the relation between the Learning Outcomes (LO) of the course, the assessment components of the course and the Exit Qualifications (EQ) of the Master’s Forensic Science (described in the Introduction in the Course Catalogue)

Fraud and plagiarism

The 'Regulations governing fraud and plagiarism for UvA students' applies to this course. This will be monitored carefully. Upon suspicion of fraud or plagiarism the Examinations Board of the programme will be informed. For the 'Regulations governing fraud and plagiarism for UvA students' see: www.student.uva.nl

Course structure

Weeknummer	Onderwerpen	Studiestof
1
2
3
4
5
6
7
8

Timetable

The schedule for this course is published on DataNose.

Last year's course evaluation

In order to provide students some insight how we use the feedback of student evaluations to enhance the quality of edcucation, we decided to include the table below in all course guides.

Cybercrime, digital traces and forensic data analysis (6EC)	N=31
Strengths Guest lectures; the emphasis was on forensics, not too technical Interesting topic and nice teachers Allocated time in the schedule for the project was very helpful	Notes for improvement The course seemed to be designed for students with a computer science background and was too difficult for students without this knowledge. Even for students with an IT background the level of lectures was too high. Students couldn’t make the connection between the lectures and the project, which made it very challenging to come up with a topic for the project. Limited feedback
Response lecturer: This course was given for the first time, so that the course could be improved was to be expected. However, the evaluation on the whole is very low and this was a surprise for the teachers as they experienced the course as very nice, most students were motivated, there was little negative feedback during the course and most groups performed well in the project work. Therefore, we followed up the PC discussion with another discussion with the student PC representatives. The following is a culmination of the advice of both discussions. At the start of the course provide a clear introduction and a clear framework. Make a link between assignment and lectures. Put students at ease that have no computer science background. Alignment project and lectures/content course will be improved. The group project should be better linked to the (guest) lectures. Getting the right detail level, not focused on the implementation of the technical skills but on the forensic application. Teachers (unfortunately) have to make the groups. Divide the computer scientists and the rest at random.

Contact information

Coordinator

Jaap van Ginkel

Owner	Master Forensic Science
Coordinator	Jaap van Ginkel
Part of	Master Forensic Science, year 1

Cybercrime, Digital Traces and Forensic Data Analysis