Print as pdf if you want a pdf! If you want a nicer printout, click off the browser's automatically added header and footer.
Blekinge Institute of Technology
Department of Computer Science
Revision: 4
Reg.no: BTH-4.1.1-0392-2023
Course syllabus
Advanced Topic in Computer Forensics
Advanced Topic in Computer Forensics
7.5 credits (7,5 högskolepoäng)
Course code: DV2579
Main field of study: Computer Science
Disciplinary domain: Technology
Education level: Second-cycle
Specialization: A1N - Second cycle, has only first-cycle course/s as entry requirements
Language of instruction: English
Applies from: 2023-08-28
Approved: 2023-03-01
1. Descision
This course is established by Dean 2017-12-20. The course syllabus is approved by Head of Department of Computer Science 2023-03-01 and applies from 2023-08-28.
2. Entry requirements
Admission to the course requires completed courses in Computer Forensics, 6 credits, Realtime Systems and Operating Systems, 6 credits, Computer Organization, 6 credits, Programming, 6 credits, Data Communication and Network Technologies , 6 credits, Network Security 1, 4 credits. Attended course in Network Security 2, 4 credits.
3. Objective and content
3.1 Objective
More and more information is handled by and stored in IT systems and this information can be of great interest when investigating suspected crime. The purpose of the course is for the student to study and work with current research findings in digital forensics technology and to provide insight into the work of security administrators and investigators in being able to identify, preserve, recreate and analyze digital traces. The results from such work can be used as support in criminal investigations or e.g. in order to be able to protect systems and information from intrusions and attacks in the future.
3.2 Content
The course covers the following areas of digital forensic technology:
Storage media – different types of properties and behavior, importance of file system for storage/deletion, identification/recovery of data of whole or part of files, especially image, video and document files.
Primary memory – virtual or physical footprint of computing usage, securing and analysis of footprints.
Handheld and embedded devices – analysis of special requirements and problems.
Networking – analysis and importance of footprints left by network usage in network equipment and computers.
4. Learning outcomes
The following learning outcomes are examined in the course:
4.1. Knowledge and understanding
On completion of the course, the student will be able to:
- explain in detail the main problems and the proposed solutions to them, within the in-depth area presented in the course.
4.2. Competence and skills
On completion of the course, the student will be able to:
- present the results of their own work in detail orally and in writing, even to non-specialists.
- identify, analyze, compare and criticize the problems and solutions proposed by various researchers and sources within the chosen field of study.
- formulate plan and implement, based on their knowledge of an area of specialization, a project task with the aim of answering a research question formulated in advance within the area of specialization.
4.3. Judgement and approach
On completion of the course, the student will be able to:
- discuss in detail various possibilities and technical, financial or other risks with a chosen research method within the chosen area of specialization.
- identify and outline the most common ethical and legal problems that can arise during a digital investigation, as well as know the most common ways to avoid them.
5. Learning activities
After a short introduction to the subject, with possible sources of relevant information, the students, in consultation with the teacher, choose an area of in-depth study. This sub-area is then presented and discussed by the students in teacher-led seminars.
The students then formulate a project task in consultation with the teacher, plan the execution and carry out the project and present the results both orally at a teacher-led seminar and in a written report. For the project, special emphasis is placed on it being well defined to answer a simpler research question in the area.
6. Assessment and grading
Modes of examinations of the course
| Code | Module | Credit | Grade |
| 2310 | Seminar | 2.0 credits | GU |
| 2320 | Project | 5.5 credits | AF |
The course will be graded A Excellent, B Very good, C Good, D Satisfactory, E Sufficient, FX Fail, supplementation required, F Fail.
The information before a course occasion states the assessment criteria and make explicit in which modes of examination that the learning outcomes are assessed.
An examiner can, after consulting the Disability Advisor at BTH, decide on a customized examination form for a student with a long-term disability to be provided with an examination equivalent to one given to a student who is not disabled.
7. Course evaluation
The course evaluation should be carried out in line with BTH:s course evaluation template and process.
8. Restrictions regarding degree
The course can form part of a degree but not together with another course the content of which completely or partly corresponds with the contents of this course.
9. Course literature and other materials of instruction
Material from the department and research articles.
10. Additional information
This course replaces DV2522
This is not a legal document. If you would like a copy of the legal decision regarding this course plan, contact the registrar at Blekinge Institute of Technology.