CYBR472 (2023) - Digital Forensics

Prescription

This course addresses the collection and analysis of the digital footprint left by humans and computers in a way that is reproducible by third-parties and suitable for presentation to a non-specialist audience. Topics include the rules of evidence, preservation of data, file system forensics, network forensics, live forensics, anti-forensics as well as forensics for non-standard devices such as mobile/smart phones, cloud computing and vehicular systems. Practical work will include labs where evidence is collected using tools and presented as well as the use, development and enhancement of these tools.

Course learning objectives

Students who pass this course should be able to:

1. Use tools to carry out the steps involved in forensic science from collecting data to preserving evidence within the context of a framework for digital forensic evidence collection and processing, and present this information to a non-specialist audience.
2. Understand the technical details of filesystems and networks and apply this understanding to the construction and evaluation of new forensics tool functionality.
3. Critically evaluate evidence obtained using digital forensics methods based upon knowledge of evidential requirements as well as technical knowledge of operating systems, networks and non-standard devices such as mobile/smart phones, cloud computing and vehicular systems.

Course content

This course is designed for in-person study, and students are strongly recommended to attend lectures, tutorials and labs on campus. In particular, some assessment items or practical hands-on labs will require in-person attendance, although exceptions can be made under special circumstances.
 
Queries about any such exceptions can be sent to remote-enrolments@ecs.vuw.ac.nz.

Withdrawal from Course

Withdrawal dates and process:
https://www.wgtn.ac.nz/students/study/course-additions-withdrawals

Lecturers

Teaching Format

There are two lectures per week which will be automatically recorded and accessible online.
 
Lab sessions are self-directed sessions and are not recorded. Students are required to read the lab documents thoroughly, complete the tasks and submit them as instructed.

Dates (trimester, teaching & break dates)

• Teaching: 27 February 2023 - 02 June 2023
• Break: 10 April 2023 - 23 April 2023
• Study period: 05 June 2023 - 08 June 2023
• Exam period: 09 June 2023 - 24 June 2023

Set Texts and Recommended Readings

Required

There are no required texts for this offering. Reading notes are provided before/after each lecture session.

Mandatory Course Requirements

In addition to achieving an overall pass mark of at least 50%, students must:

• Achieve at least a "D" in the case study assessment because this is where you will demonstrate your understanding of and ability to apply what you have learnt in the course.

If you believe that exceptional circumstances may prevent you from meeting the mandatory course requirements, contact the Course Coordinator for advice as soon as possible.

Assessment

Assessment Item	Due Date or Test Date	CLO(s)	Percentage
Assignment one - written answers to questions	Week 5	CLO: 2	30%
Assignment two - case study	Week 10	CLO: 1,3	40%
Assignment three - presentation	During assessment period	CLO: 2	30%

Penalties

Late submission will incur a penalty of 10% shrinking cap per day after the available late days are used. Shrinking cap reduces the maximum mark achievable per day - so for example after 3 days the maximum grade is 70%. The calculation is done on a pro-rata basis so 2 hours late is a penalty of 1/12th of 10%.

Extensions

The course allows 3 late days on individual assignments. Extensions should be negotiated with the course coordinator before the deadline whenever possible. Documentation (eg, medical certificate) may be requested.

Submission & Return

All work should be submitted through the ECS submission system, accessible through the course web pages. Marks and comments will be returned through the ECS marking system, also available through the course web pages.
 
Student submitted work may be used during the formal Engineering NZ re-accreditation visit to VUW scheduled for 2024, as part of the evaluation process for the programme.

Marking Criteria

We will publish a high-level marking rubric for each assignment.

Required Equipment

The case study requires you to run multiple virtual machines. We test these on our laboratory machines but if you are distance student make sure that you have a machine that has at least 8Gb of memory.

Workload

The student workload for this course is 150 hours.

Teaching Plan

See https://ecs.wgtn.ac.nz/Courses/CYBR472_2023T1/LectureSchedule

Communication of Additional Information

All online material for this course can be accessed at https://ecs.wgtn.ac.nz/Courses/CYBR472_2023T1/

Links to General Course Information

• Academic Integrity and Plagiarism: https://www.wgtn.ac.nz/students/support/student-interest-and-conflict-resolution/academic-integrity
• Academic Progress: https://www.wgtn.ac.nz/students/study/progress/academic-progess (including restrictions and non-engagement)
• Dates and deadlines: https://www.wgtn.ac.nz/students/study/dates
• Grades: https://www.wgtn.ac.nz/students/study/progress/grades
• Special passes: Refer to the Assessment Handbook, at https://www.wgtn.ac.nz/documents/policy/staff-policy/assessment-handbook.pdf
• Statutes and policies, e.g. Student Conduct Statute: https://www.wgtn.ac.nz/about/governance/strategy
• Student support: https://www.wgtn.ac.nz/students/support
• Students with disabilities: https://www.wgtn.ac.nz/st_services/disability/
• Student Charter: https://www.wgtn.ac.nz/learning-teaching/learning-partnerships/student-charter
• Student Feedback on University courses may be found at: http://www.cad.vuw.ac.nz/feedback/feedback_display.php
• Terms and Conditions: https://www.wgtn.ac.nz/study/apply-enrol/terms-conditions/student-contract
• Turnitin: http://www.cad.vuw.ac.nz/wiki/index.php/Turnitin
• University structure: https://www.wgtn.ac.nz/about/governance/structure
• The Use of Te Reo Māori for Assessment Policy:
  Victoria University values te reo Māori. Students who wish to submit any of their assessments in te reo Māori must refer to The Use of Te Reo Māori for Assessment Policy
  He mea nui te reo Māori ki te Whare Wānanga o te Ūpoko o te Ika. Ki te pīrangi koe ki te tuhituhi i ō aro matawai i roto i te reo Māori, tēnā me mātua whakapā atu ki te kaupapa here, The Use of Te Reo Māori for Assessment Policy
• VUWSA: http://www.vuwsa.org.nz

Offering CRN: 32240

Points: 15
Prerequisites: CYBR 271, 371, 30 further 300-level pts from (CYBR, NWEN, SWEN 324, 326)
Duration: 27 February 2023 - 25 June 2023
Starts: Trimester 1
Campus: Kelburn