CYBR472 (2023) - Digital Forensics


This course addresses the collection and analysis of the digital footprint left by humans and computers in a way that is reproducible by third-parties and suitable for presentation to a non-specialist audience. Topics include the rules of evidence, preservation of data, file system forensics, network forensics, live forensics, anti-forensics as well as forensics for non-standard devices such as mobile/smart phones, cloud computing and vehicular systems. Practical work will include labs where evidence is collected using tools and presented as well as the use, development and enhancement of these tools.

Course learning objectives

Students who pass this course should be able to:

  1. Use tools to carry out the steps involved in forensic science from collecting data to preserving evidence within the context of a framework for digital forensic evidence collection and processing, and present this information to a non-specialist audience.
  2. Understand the technical details of filesystems and networks and apply this understanding to the construction and evaluation of new forensics tool functionality.
  3. Critically evaluate evidence obtained using digital forensics methods based upon knowledge of evidential requirements as well as technical knowledge of operating systems, networks and non-standard devices such as mobile/smart phones, cloud computing and vehicular systems.

Course content

This course is designed for in-person study, and students are strongly recommended to attend lectures, tutorials and labs on campus. In particular, some assessment items or practical hands-on labs will require in-person attendance, although exceptions can be made under special circumstances.
Queries about any such exceptions can be sent to

Withdrawal from Course

Withdrawal dates and process:


Dr Masood Mansoori (Coordinator)

Teaching Format

There are two lectures per week which will be automatically recorded and accessible online.
Lab sessions are self-directed sessions and are not recorded. Students are required to read the lab documents thoroughly, complete the tasks and submit them as instructed.

Dates (trimester, teaching & break dates)

  • Teaching: 27 February 2023 - 02 June 2023
  • Break: 10 April 2023 - 23 April 2023
  • Study period: 05 June 2023 - 08 June 2023
  • Exam period: 09 June 2023 - 24 June 2023

Class Times and Room Numbers

27 February 2023 - 02 April 2023

  • Friday 12:00 - 12:50 – 302, Murphy, Kelburn
27 February 2023 - 09 April 2023

  • Tuesday 12:00 - 12:50 – 302, Murphy, Kelburn
24 April 2023 - 04 June 2023

  • Tuesday 12:00 - 12:50 – 302, Murphy, Kelburn
  • Friday 12:00 - 12:50 – 302, Murphy, Kelburn


There are no required texts for this offering. Reading notes are provided before/after each lecture session.

Mandatory Course Requirements

In addition to achieving an overall pass mark of at least 50%, students must:

  • Achieve at least a "D" in the case study assessment because this is where you will demonstrate your understanding of and ability to apply what you have learnt in the course.

If you believe that exceptional circumstances may prevent you from meeting the mandatory course requirements, contact the Course Coordinator for advice as soon as possible.


Assessment ItemDue Date or Test DateCLO(s)Percentage
Assignment one - written answers to questionsWeek 5CLO: 230%
Assignment two - case studyWeek 10CLO: 1,340%
Assignment three - presentationDuring assessment periodCLO: 230%


Late submission will incur a penalty of 10% shrinking cap per day after the available late days are used. Shrinking cap reduces the maximum mark achievable per day - so for example after 3 days the maximum grade is 70%. The calculation is done on a pro-rata basis so 2 hours late is a penalty of 1/12th of 10%.


The course allows 3 late days on individual assignments. Extensions should be negotiated with the course coordinator before the deadline whenever possible. Documentation (eg, medical certificate) may be requested.

Submission & Return

All work should be submitted through the ECS submission system, accessible through the course web pages. Marks and comments will be returned through the ECS marking system, also available through the course web pages.
Student submitted work may be used during the formal Engineering NZ re-accreditation visit to VUW scheduled for 2024, as part of the evaluation process for the programme.

Marking Criteria

We will publish a high-level marking rubric for each assignment.

Required Equipment

The case study requires you to run multiple virtual machines. We test these on our laboratory machines but if you are distance student make sure that you have a machine that has at least 8Gb of memory.


The student workload for this course is 150 hours.

Teaching Plan


Communication of Additional Information

All online material for this course can be accessed at

Offering CRN: 32240

Points: 15
Prerequisites: CYBR 271, 371, 30 further 300-level pts from (CYBR, NWEN, SWEN 324, 326)
Duration: 27 February 2023 - 25 June 2023
Starts: Trimester 1
Campus: Kelburn