Mar 19, 2024  
2021-2022 Course Catalog 
    
2021-2022 Course Catalog [ARCHIVED CATALOG]

Add to Portfolio (opens a new window)

NET 373 - Forensic Prac Cybersecurity

Credits: 4
Lecture Hours: 2
Lab Hours: 4
Practicum Hours: 0
Work Experience: 0
Course Type: Voc/Tech
Upon completion of this course, students will be familiar with the interface, file management, resource allocation and common administration procedures of various popular operating systems. The course describes data organization and file properties that contribute to forensic investigation. Additional topics include a strong emphasis on investigative documentation, recognition of potential evidence sources, sterile evidence acquisition and analysis, and data recovery methodologies. State-of-the-art hardware and software will be used in hands-on labs and case studies.
Competencies
 

  1. Interpret computer codes and numbering systems
    1. Describe ASCII codes
    2. Explain Binary numbering systems
    3. Explain Hexadecimal numbering systems
  2. Evaluate purpose of a computer operating system (OS) and its components
    1. Define kernel
    2. Differentiate between single-user and multi-user systems
    3. Explain file management
    4. Explain memory management including virtual memory/swap space
    5. Explain OS security
  3. Compare and contrast the main user features and typical user data of various, PC-class, operating systems including but not limited to
    1. DOS
    2. Windows NTx (NT, 2K, XP, Vista, Server 20xx, Win7, Win8, Win10)
    3. UNIZ/POSIX (Linux/OS X)
  4. Demonstrate effective use of a Hex Editor application.
    1. Explain the term offset.
    2. Practice inserting, altering, deleting, and carving data using the software tool.
    3. Describe HPFS
    4. Describe NFS
    5. Describe HFS Plus
  5. Assess significance and key components of boot records.
    1. Contrast Master Boot Record (MBR) and GUID Partition Table (GPT) organizational schemes.
    2. Decode appropriate data structures to identify volume parameters on a storage device.
    3. Identify file attributes and permissions
    4. Describe metadata
    5. Describe beneficial OS-specific artifacts and logs
  6. Understand and identify different file systems, including respective data saving, recall and deletion methods.
    1. Describe FAT/FAT16/FAT32.
    2. Describe NTFS
    3. Describe exFAT.
    4. Describe Extended File System (ext2/ext3/ext4).
    5. Describe HFS Plus.
  7. Analyze primary user data and OS artifacts.
    1. Describe file naming conventions.
    2. Describe dating methods (creation/modification/access).
    3. Identify file attributes and permissions.
    4. Recognize common file extensions including, but not limited to: .txt, .pdf, .doc, .docs, .xls, .jpg, .gif, .bmp, .tmp, .htm, .xml, .log, .zip.
    5. Explain the correlation of “magic numbers”/file signatures and specific application data.
    6. Describe metadata.
    7. Describe beneficial OS-specific artifacts and logs.
  8. Demonstrate appropriate evidence acquisition techniques
    1. Document system physical topology
    2. Document logical system characteristics including BIOS properties, boot configurations and date/time settings
  9. Assess common secondary data storage
    1. Identify physical interfaces
    2. Differentiate between magnetic and solid state storage
    3. Describe standard hard drive geometry, addressing, and configuration
    4. Describe purpose/functionality of RAID
    5. Define slack
    6. Describe optical storage solutions
  10. Demonstrate appropriate procedures for forensic duplication
    1. Describe the purpose of and demonstrate proper wiping techniques
    2. Show proper write-blocking using accepted methods
    3. Describe the function of hash values in authentication of data acquisition
    4. Describe the function of compression in data acquisition
  11. Analyze data
    1. Use manual methods to retrieve data
    2. Use popular tools to automate analysis including EnCase and FTK
    3. Apply data hash value comparisons to improve efficiency
  12. Examine typical user data and system files using automated tools
    1. Perform searches using various keywords and contextual indicators
    2. Examine data contained in compressed data files/containers



Add to Portfolio (opens a new window)