Course manual 2021/2022

Course content

The following topics/subjects will be addressed:

Digital Forensics and cybercrime intro
Acquisition, Hashing/integrity
Live forensics/ memory forensics
(Smart)phone forensics
Embedded/Device forensics
Network forensics
Multimedia forensics
Big Data forensics

Objectives

Evaluate the theory and application of scientific principles and techniques involved in digital forensics.
Select, re-use, adapt and apply relevant computer science techniques to (parts of) a digital crime scene.
Analyse and organise a digital data set.
Generate alternative hypotheses and prioritize items of digital evidence.
Judge the methods used in digital forensics investigation based on the appropriateness of the methods and explain the scientific basis of those methods.
Evaluate the strengths and weaknesses of digital forensic techniques.

Teaching methods

Lecture
Presentation/symposium
Self-study
Computer lab session/practical training

Learning activities

Activity	Hours
Hoorcollege	26
Presentatie	8
Werkcollege	52
Self study	82
Total	168	(6 EC x 28 uur)

Attendance

This programme does not have requirements concerning attendance (OER part B).

Additional requirements for this course:

It is presupposed that all students will be present in class.

Assessment

Item and weight	Details
Final grade
30% Presentation	Must be ≥ 5.5, Mandatory
70% Report	Must be ≥ 5.5, Mandatory

All components will be graded on a scale of 1-10. In order to pass the course, all components and the final grade have to be sufficient, i.e. at least a five and a half. When a student has not fulfilled this requirement, the examiner will register the mark ‘did not fulfill all requirements’ (NAV) whether or not the averaged grade is sufficient. The components will be weighted as follows:

1. report (70%)
2. presentation (30%)

The students will work in groups on the project.

The final grade will be announced at the latest on 26st of April (= 15 working days after the final course activity). Between the 26st of April to May 23rd (= 35 working days after the final course activity) an inspection moment will be planned. This will be announced on Canvas and/or via email.

LO	Tested in component	EQ 1	EQ 2	EQ 3	EQ 4	EQ 5	EQ 6	EQ 7	EQ 8	EQ 9	EQ 10
1	1, 2		x					x
2	1, 2				x
3	1, 2					x
4	1, 2				x
5	1, 2				x				x
6	1, 2		x					x

Table of specification: the relation between the Learning Outcomes (LO) of the course, the assessment components of the course and the Exit Qualifications (EQ) of the Master’s Forensic Science (described in the Introduction in the Course Catalogue)

Fraud and plagiarism

The 'Regulations governing fraud and plagiarism for UvA students' applies to this course. This will be monitored carefully. Upon suspicion of fraud or plagiarism the Examinations Board of the programme will be informed. For the 'Regulations governing fraud and plagiarism for UvA students' see: www.student.uva.nl

Course structure

Weeknummer	Onderwerpen	Studiestof
1
2
3
4
5
6
7
8

Timetable

The schedule for this course is published on DataNose.

Last year's course evaluation

In order to provide students some insight how we use the feedback of student evaluations to enhance the quality of edcucation, we decided to include the table below in all course guides.

Cybercrime, digital traces and forensic data analysis (6EC)	N=15
Strengths Expert lectures were really good (Zeno, Meike and Jaap) Project was super appreciated Guest lectures were really enthusiastic	Notes for improvement Expectations report and presentation unclear. Level of lectures were too high for the non-computer science students, the guest lecturers sometimes went too much into depth of the computer science details. The scheduled activities were too long.
Response lecturer: The course has been improved. The main lecturers have adjusted their lectures with less technical details. In addition, we had the support of a teaching assistant this year to help students with their projects. This worked very well. The results of the evaluation are puzzling and demotivating. Teachers have put a lot of effort into the course, it was not easy due to corona and online teaching. The teachers felt that the students produced great work in the projects and showed high level insight into the forensic relevance. It was something to be proud of.During the course teachers regularly checked in how things were going, if anything was unclear also regarding the lectures. The teaching assistant introduced a workform in which students were taught how to program, so students could experience at the start of the course that they can actually do it. Teachers also instructed the groups not to do too technical projects as this is not necessary. Students gave positive responses and were also invested and enthusiastic about the projects. The teachers feel there is a big difference between the responses of the students during the course and the evaluation afterwards. Teachers indicated that to decrease the technical level even more would mean dumming down the course and is not desirable. For next year the expectation management is important. For a large part of the group this is an entirely new field. This happens in other courses too, but the digital field is an essentially different field, with different methodological approaches and learning approaches (for example first try out and then write down). It is important students are aware of this. Students with a digital background will be divided over the groups.

Contact information

Coordinator

Jaap van Ginkel

Owner	Master Forensic Science
Coordinator	Jaap van Ginkel
Part of	Master Forensic Science, year 1

Cybercrime, Digital Traces and Forensic Data Analysis