THE UNIVERSITY OF TEXAS AT AUSTIN MIS373 e-discovery and Digital Forensics SPRING 2015 Unique#: (03883) VERSION: 1/23/2015

Transcription

1 THE UNIVERSITY OF TEXAS AT AUSTIN MIS373 e-discovery and SPRING 2015 Unique#: (03883) VERSION: 1/23/2015 Instructor : Juan Reyes, Lecturer Class times : Monday and Wednesday, 3:30-5:00pm Class location : CBA Instructor s Office : CBA Office Phone : Mobile+Text : juan.reyes@mccombs.utexas.edu Office Hours: By appointment (after class is typically best for me) Course Objectives This course provides an introduction to the disciplines of e-discovery (electronic discovery) and digital forensics. You will gain an understanding of how the two, as standalone and interrelated disciplines, contribute to justice prevailing within litigation scenarios. The following are among the areas that this course will cover: Identification, collection, and production of electronically stored information (ESI). e-discovery and professional competence guidelines. Use of digital forensics tools. Documenting findings within a report. Litigation preparation. Course Materials and Web Page Course syllabus, announcements, assignment, lecture presentations and other course material will be posted on Canvas (canvas.utexas.edu). Canvas will also be used to administer assignments, tests, and grade reporting. Grading Contributions to in-class discussions: 15% *Turn-In Assignments 20% ** Individual Project 20% ***Team Project 20% ****Take-Home Final 25% Contributing requires that you engage in class discussions and activities, of course, and it fundamentally requires class attendance. Attendance will be tracked. You ll need to sign the attendance sign-in roster every class session in order to receive credit for attendance. * There will be Turn-In Assignments, both homework and in-class exercises, that you will turn in via Canvas. I will announce assignments via Canvas and/or in class.

2 ** The Individual Project will be discussed in more detail as the class progresses. The intent of the Individual Project is to give you the opportunity to expand on an area or areas of e- Discovery and that interest you. Topics may vary since it is your choice. I do require a minimum of 10 double-spaced pages with a 12 point font, bold letter section headers, and a reference page. APA format may certainly be used, though isn t required. I ll post a template for you to reference. Clean and effective aesthetic style is important in all business communications. The Individual Project will be due on March 11th, the last course day before spring break. *** The Team Project (and who doesn t love Team Projects?) will be as the name implies. I will be assigning teams to perform complete projects that encompass comprehension of legal documentation and technical competencies in relation to e-discovery and Digital Forensics. Each team will give a minute presentation in the month of May. Each team will submit the presentation to me as well. **** The Take-Home Final will be 70 multiple choice questions that will draw directly from the turn-in assignments and reading materials that you will be working on throughout the span of the course. Each question will be worth 1 point out of 100. Additionally, there will be 3 essay questions pertaining to e-discovery and worth 10 points each. These may draw from class discussions and assignments and/or they may you require you to do some independent research. Quality trumps quantity in your essay question answers. The final will be posted on Canvas by 12 PM Noon on Monday May 11 th for you to download and complete. The completed final needs to be turned in by 5PM on Friday May 15 th. Textbook This course does not have any required textbooks that you need to purchase. The following books will be used as reference materials. E-Discovery: An Introduction to Digital Evidence by Amelia Phillips. Computer Forensics: InfoSec Pro Guide by David Cowen. I will post reading assignments from various sources for discussion in class. Computing Because hands-on contact with digital forensics tools is important (in addition to being fun) to the learning process we seek to accomplish with this course, we will be using the SANS Investigative Forensic Toolkit (SIFT) Workstation to gain familiarity with technical tools and methods used in digital forensics. The SIFT toolkit is a virtual machine (VM) that requires use of one of the free VMware options for Mac and PC. You do not have to have the SIFT workstation ready to go on the first day of class. Getting all students up and running on SIFT could be a bit of a project in and of itself - it could take 2 or more weeks. It is fairly straightforward as far as installing and running but exception cases do occur. Establishing schedules for SIFT exercises and assignments will be dictated by how soon everyone has a functioning SIFT workstation to work with. I will post further information about SIFT no later than the second week of class.

3 Laptops should be brought to every class session. Schedule We can think of the course as having two halves - Before Spring Break and After Spring Break. In the Before Spring Break half, we ll be delving into topics at more of the conceptual level and remain light to intermediate on technical depth. In the After Spring Break half, we ll take the foundations laid out in the first half and build upon them in more depth technically especially with the digital forensics. The schedule below is tentative. I have two pending responses from industry professionals to do guest speaker engagements and their availability will dictate slight changes to the schedule. Also, the completion time at which the whole class is up and running with SIFT will also likely dictate some degree of schedule modification. Please fear not - I will not in any way allow schedule changes to put you in any form of a crunch that could create assignment completion issues that might affect your assignment grades. I will post schedule revisions as needed on Canvas. Tentative Schedule: Session Date Topic Subtopic 1 W-21- Jan 2 M-26- Jan 3 W-28- Jan Introduction e-discovery & e-discovery & Syllabus, introductions, course overview. Defining ESI, metadata, introduction to digital forensics tools. How to read a case, digital forensics tools. 4 M-2-Feb e-discovery & 5 W-4-Feb e-discovery & 6 M-9-Feb e-discovery & 7 11-Feb e-discovery & 8 16-Feb e-discovery & Litigation case discussion, digital forensics tools. Electronic Discovery Reference Model, digital forensics tools. e-discovery Scope, e-discovery Planning, Trial Considerations. Managing e-discovery, competence factor, digital forensics tools. Evidence case flow,digital forensics tools.

4 9 18-Feb e-discovery & Feb e-discovery & Litigation case discussion, digital forensics tools. Preserving digital evidence, Web-based repositories, relevant data identification and review Feb e-discovery & Pre-litigation investigation, sampling and metrics, pretrial motions Mar e-discovery & 13 4-Mar e-discovery & Information Governance, preparing for litigation. Case law, appeals, multi-jurisdiction and international cases Mar e-discovery & Mar e-discovery & e-discovery future, anti-forensics, emerging trends. Individual projects due. Mid-term course review lecture. ** 16-Mar Spring Break *** ** 18-Mar Spring Break *** Mar e-discovery & Mar e-discovery & Mar e-discovery & 19 1-Apr e-discovery & 20 6-Apr e-discovery & 21 8-Apr e-discovery & Litigation case study and digital forensics tools.

5 22 13-Apr e-discovery & Apr e-discovery & Apr e-discovery & Apr e-discovery & Apr e-discovery & Apr e-discovery & 28 4-May e-discovery & 29 6-May e-discovery & ** 11-May No Class Day The final exam will be posted on Canvas by 12PM May Course wrap-up Course wrap-up. ** 15-May Final exam due Turn in the final via Canvas by 5PM. Students with Disabilities Students with disabilities may request appropriate academic accommodations from the Division of Diversity and Community Engagement, Services for Students with Disabilities, , Religious Holy Days By UT Austin policy, you must notify me of your pending absence at least fourteen days prior to the date of observance of a religious holy day. If you must miss a class, an examination, a work assignment, or a project in order to observe a religious holy day, you will be given an opportunity to complete the missed work within a reasonable time after the absence. Policy on Scholastic Dishonesty The McCombs School of Business has no tolerance for acts of scholastic dishonesty. The

6 responsibilities of both students and faculty with regard to scholastic dishonesty are described in detail in the BBA Program s Statement on Scholastic Dishonesty at By teaching this course, I have agreed to observe all faculty responsibilities described in that document. By enrolling in this class, you have agreed to observe all student responsibilities described in that document. If the application of the Statement on Scholastic Dishonesty to this class or its assignments is unclear in any way, it is your responsibility to ask me for clarification. Students who violate University rules on scholastic dishonesty are subject to disciplinary penalties, including the possibility of failure in the course and/or dismissal from the University. Since dishonesty harms the individual, all students, the integrity of the University, and the value of our academic brand, policies on scholastic dishonesty will be strictly enforced. You should refer to the Student Judicial Services website at to access the official University policies and procedures on scholastic dishonesty as well as further elaboration on what constitutes scholastic dishonesty. Campus Safety Please note the following recommendations regarding emergency evacuation, provided by the Office of Campus Safety and Security, , Occupants of buildings on The University of Texas at Austin campus are required to evacuate buildings when a fire alarm is activated. Alarm activation or announcement requires exiting and assembling outside. Familiarize yourself with all exit doors of each classroom and building you may occupy. Remember that the nearest exit door may not be the one you used when entering the building. Students requiring assistance in evacuation should inform the instructor in writing during the first week of class. In the event of an evacuation, follow the instruction of faculty or class instructors.do not re-enter a building unless given instructions by the following: Austin Fire Department, The University of Texas at Austin Police Department, or Fire Prevention Services office. Behavior Concerns Advice Line (BCAL): Further information regarding emergency evacuation routes and emergency procedures can be found at: