SYLLABUS POSTGRADUATE TRAINING FOR NORDIC COMPUTER FORENSIC INVESTIGATORS. Module 3E Windows Forensics 10 ECTS

Transcription

1 SYLLABUS POSTGRADUATE TRAINING FOR NORDIC COMPUTER FORENSIC INVESTIGATORS Module 3E Windows Draft for the Board at NPUC 2 December2015 (5 November)

2 1. Introduction Personal computing has for years been dominated by Windows operating system (OS). Most personal computers have Windows operating system (OS) installed, and Windows is embedded as OS on small-scaled devices like smart phones and tablets. As new versions of Windows are being developed, computer forensic investigators need to have in-depth knowledge of the artefacts found in the different Windows versions, with the ultimate goal of achieving successful prosecution of a case in court. The NCFI program consists of the following modules: Module 3A Forensic Tool Development Module 3B Linux Artefacts Module 3C Open Source Module 3D Macintosh Computer Module 3E Windows 10 ETCS Other module parts Module 2: Nordic Computer Forensic Investigators - 25 ECTS Module 1: Nordic Computer Forensic Investigators, Introduction - 5 ECTS 2. Aim The aim of this program is to ensure that the quality of computer forensic investigation is of a high level, guaranteeing legal protection and the right to privacy. 3. Target group and admission criteria 3.1. Target group The primary target group is police staff in the Nordic countries whose main task is handling and investigating digital evidence. It is a prerequisite that participants are selected in accordance with local competency plans. Curriculum for Nordic Computer Forensic Investigators, Module 3E Page 2

3 Employees in other Nordic governmental agencies which cooperate with the police and work with digital evidence on a daily basis are also entitled to apply Admission criteria Applicants for module 3E must: be employed by a governmental agency have passed NCFI 2 (Nordic Computer Forensic Investigators, module 2) or have similar education have at least one year of experience in digital forensic or cybercrime investigation 4. Learning outcome 4.1. General competence After completion of the module candidates will: perform professional tasks in the role of digital forensic investigator with increased insight and confidence have a deeper understanding of the importance of artefacts in digital forensics see the role of digital forensics in a broader perspective during an investigation identify ethical and legal issues during investigation 4.2. Knowledge After completion of the module candidates will have advanced knowledge about: the most frequently used Windows file systems automation in Windows OSes the location of different artefacts within Windows 4.3. Skills After completion of the module candidates will be able to: utilise Windows Scripting in an investigation evaluate the relevance of Windows artefacts in relation to an investigation conduct advanced Live Data Forensic techniques on a Windows system analyse Windows file systems and utilise the findings in an investigation Curriculum for Nordic Computer Forensic Investigators, Module 3E Page 3

4 5. Organisation and Study Requirements This module is delivered on-line through a combination of lectures, exercises, quizzes and assignments. The approximate duration of the module is 280 hours of study. Students are expected to complete the program within 4 months. Student support will be delivered via electronic means such as: , discussion fora, chat and virtual classrooms. An e-learning platform is used for the administration and implementation of the module. Study requirements The following requirements have to be fulfilled and approved before students may sit the exam: Two assignments. One web-based campus week 6. Assessment The program is concluded with an examination consisting of two parts: A project conducted by the students during the last part of the program A 4-hour written examination Grading is from A E, which are pass grades, and F, which is a fail grade. Both parts of the examination must be passed, and are each weighted 50%. 7. Literature 7.1. Mandatory literature Elrick, D (2014): Forensic Examination of Windows Supported File Systems, USA. Chapter 13 (26 pages). ISBN Curriculum for Nordic Computer Forensic Investigators, Module 3E Page 4

5 Sammes, T., Jerkinson B. (2007): Forensic Computing - A practitioner's Guide. UK: Springer. Chapter 6. (61 pages). ISBN A number of specific web resources and research articles will be provided to students during the course. These will form part of the mandatory reading requirements and will be examinable. There are 87 pages of mandatory literature from books and approximately 400 pages from lessons, web resources and research papers Assumed knowledge Mandatory literature from NCFI Module 2. Curriculum for Nordic Computer Forensic Investigators, Module 3E Page 5