Curriculum

These are the course requirements that lead to the master's degree in Digital Forensic Science. Courses are subject to change.

Course Name

Course descriptions:

DIM500: The Practice of Digital Investigation

This course will provide the basis for the program of study and introduce core principles of forensic science and evidence management. Students will examine the mission of digital forensics from the various perspectives of the public and private sectors. That includes digital forensics in support of activities ranging from internal corporate investigations, responses to information security incidents, and policy auditing to third-party investigations, criminal investigations, and anti-terrorism information gathering — and discussing the imperatives of each.

DIM550: Laboratory Operation and Accreditation

Students will learn about practices and issues related to the management of a computer forensics lab for the public or private sector. Topics will include best practices in lab operation, case management, and evidence management and storage; maintaining proficiency; personnel training and certification; and development of policies and procedures. Accreditation from organizations such as the American Society of Crime Laboratory Directors (ASCLD) and compliance with standards such as ISO 17025 will be discussed, including pros and cons, the cost and process of compliance, and impact on employees and processes.

DIM570: Research Methodology

Students will get an overview of the research process from the experimental, developmental and evaluative perspectives. Techniques will be examined for planning and designing different types of projects, as well as the methodologies for data collection, evaluation and analysis. Students will gain an understanding of related statistical measures. Developing conclusions based on data analysis, in terms of predefined hypotheses and project goals and objectives, also will be discussed.

MBA505: The Strategic Language of Business

This course provides students with an introduction to the strategic and tactical functions of all organizations. Students will develop a framework of understanding for the general language, concepts, organizational principles and functions of management. The course will be an uncomplicated journey through the traditional functional topics of business, using a combination of information-sharing and the Integrated Reflective Practice model.

DFS510: Scripting for Digital Forensics

With the rapid development of new technology, there is often a considerable lag between the release of digital devices, software and operating systems and the development of commercial tools for their analysis. This course will teach students to use scripting languages for the analysis of data. Another use for scripting is dealing with large volumes of data through automation. Students will learn about two scripting languages. No prior programming experience is required.

DFS520: Operating System Analysis

This course will examine in considerable depth how file and operating systems determine the type of information available to examiners. In particular, the design and behavior of these systems will be discussed, and students will learn to recover information from these systems at the binary level. The features and limitations of current forensic software tools also will be covered, with particular attention paid to the techniques by which the automated tools interpret data. A range of operating systems will be examined, including PC, mobile phone and embedded systems.

DFS530: Incident Response and Network Forensics

Students will learn to collect and interpret information from network traffic, network devices, servers and operating systems. The network traffic section will cover methods of collecting and analyzing traffic, including TCP/IP structure and higher-level protocols. The network device section will focus on dealing with network devices such as routers, switches and firewalls. And the incident response section will cover technical and procedural approaches and processes for dealing with information technology security incidents.

DFS540: Malware Analysis

This course will cover different methods of malware analysis and their respective strengths and weaknesses. Students will gain insight into malware behavior, including infection vectors, propagation and persistence mechanisms, and artifacts. Students will learn methods of behavioral analysis using controlled environments and reverse engineering. A range of malware types—Web-based, Trojan, rootkits and bots—will be examined.

DFS550: Mobile Device Analysis

Students will learn to preserve and analyze data on a range of mobile electronic devices, such as mobile phones, tablets, e-book readers and GPS systems. At the conclusion of the course, students will know how to use and evaluate different methods of data preservation, including removal and download of data from silicon chips, software synchronization and forensic software. Students also will be able to develop methods to interpret data copied from these devices.

DIM550: Digital Investigation for Civil Litigation

The course introduces principles of digital investigations that are specific to civil litigation. While litigation support services typically utilize many of the same tools, processes and procedures as public sector criminal investigations, private sector use of computer forensics frequently involves issues that the public sector does not often consider, such as data recovery and restoration, erasure of media and electronic discovery. Students will examine case studies of public sector digital investigations to compare with private sector methodologies.

DFS580 & DFS581: Capstone Research Project 1& 2 (6 credits)

The course will give students the opportunity to integrate all disciplines and competencies they've learned in the program into a single work-based project, internship experience or other appropriate activity. The project will be the culmination of a student's studies integrated with their area of specialization or expertise. With an adviser, the student will design, research and implement a comprehensive project that addresses, to the extent feasible, all core areas of knowledge around which the program has been built.

Students will have a residency at the renowned Digital Forensic Research Workshop.