Course Resources Archive

This module considers the stages of a forensic computing process that manages the flow of evidence from a (cyber) crime-scene to a courtroom.

The collection stage: search and seizure of electronic evidence from crime scenes, and maintenance of the chain-of-custody. The examination stage: recovery of digital evidence from electronic evidence, both on computers and on networks. The analysis stage: identification of artifacts in the digital evidence that support/refute a line of enquiry. The reporting stage: preparation of a case for presentation in court, the duty of disclosure, the role of expert witness, and ethics.

A student passing this module should be able to:

1. Plan and carry out a search and seizure operation, demonstrating an awareness of the law of evidence. 
2. Select appropriate tools and use them to carry out the recovery of digital evidence from data storage devices ;
3. Select appropriate tools, and then use them to carry out the recovery of digital evidence from computer networks;
4. Analyse digital evidence, and identify the possible location of further digital evidence.
5. Perform the recovery of digital artefacts from digital evidence, interpret them, and assess their contribution to a case.
6. Communicate and present the nature and weight of digital artefacts, and drawing appropriate conclusions from them.

The Library Catalogue contains full details of the current reading list for this module. Further details may also be found in the Module Guide.