NET 373 - Forensic Prac Cybersecurity

Credits: 4
Lecture Hours: 2
Lab Hours: 4
Practicum Hours: 0
Work Experience: 0
Course Type: Voc/Tech

Upon completion of this course, students will be familiar with the interface, file management, resource allocation and common administration procedures of various popular operating systems. The course describes data organization and file properties that contribute to forensic investigation. Additional topics include a strong emphasis on investigative documentation, recognition of potential evidence sources, sterile evidence acquisition and analysis, and data recovery methodologies. State-of-the-art hardware and software will be used in hands-on labs and case studies.
Competencies

Interpret computer codes and numbering systems
1. Describe ASCII codes
2. Explain binary numbering systems
3. Explain hexadecimal numbering systems
Employ a course of action through critical thinking
1. Develop problem-solving skills
2. Reinforce fundamental knowledge and skills through new situations
3. Defend proposed solution or course of action
4. Formulate opinions based on knowledge and experience
Evaluate purpose of a computer operating system (OS) and its components
1. Define kernel
2. Differentiate between single-user and multi-user systems
3. Contrast file management implementations
Apply the effective use of a Hex Editor application
1. Demonstrate identifying data offsets.
2. Practice inserting, altering, deleting, and carving data manually and using the software tools
3. Perform binary math using XOR, ADD, ADD, and subtract
Evaluate binary encryption schemes
1. Define what encryption is
2. Contrast different binary encryption methods
3. Interpret binary level encryption methods
4. Interpret binary level decryption methods
Distinguish file types by their signatures
1. Classify common file extensions including, but not limited to: .txt, .pdf, .doc, .xls, .jpg, .gif, .bmp, .tmp, .htm, .log, .zip
2. Explain the correlation of “magic numbers”/file signatures and specific application data
3. Recover deleted data based on their signature
Explore the key components of the Master Boot Record (MBR) Partitioning
1. Break down the MBR partition table
2. Examine sectors and clusters
3. Differentiate between partitions and volumes
4. Recover deleted MBR partitions
Examine the key components of the GUID Partition Table
1. Differentiate the Master Boot Record (MBR) and GUID Partition Table (GPT) organizational schemes
2. Decode appropriate the partition header
3. Decode the GPT partition table
4. Diagram the backup partition table
5. Recover deleted GPT partitions
Explain the primary OS artifacts
1. Describe file naming conventions
2. Describe dating methods (creation/modification/access)
3. Identify file attributes
4. Describe metadata
Analyze the FAT file systems
1. Differentiate between FAT16 and FAT32
2. Parse the FAT volume boot record
3. Parse the FAT directory structure
4. Outline how files are saved in a FAT file system
5. Outline what occurs when a file is deleted
6. Recover deleted files
7. Outline what occurs when drive is formatted with a FAT file system
Analyze the NTFS file system
1. Differentiate between FAT and NTFS
2. Parse the NTFS volume boot record
3. Characterize the Metadata file system files
4. Parse the $MFT structure
5. Outline how files are saved in a NTFS file system
6. Outline what occurs when a file is deleted
7. Outline what occurs when drive is formatted with a NTFS file system
Examine the exFAT file system.
1. Differentiate between FAT and NTFS and exFAT
2. Parse the exFAT volume boot record
3. Characterize the Metadata file system files
4. Parse the exFAT directory structure
5. Outline how files are saved in a exFAT file system
6. Outline what occurs when a file is deleted
7. Outline what occurs when drive is formatted with an exFAT file system

Competencies Revised Date: AY2022