Digital Forensics MSc

• Dr Graeme Horsman

This module provides a general introduction to the awards associated with the MSc Digital Forensics, and the principles underpinning the course. It orients students and provides research skills to prepare students for their subsequent programme of study on the assessed modules. The discussion sessions provide students with an opportunity to network and gain confidence in expressing evidenced professional opinions.

The emphasis in Introductory Studies is on preparing students access and use teaching and University resources. Topics include:

• Course overview and module details,
• Introduction to University facilities and using University Library,
• Student obligations and expectations,
• Coursework submission process and referencing standards,
• Use of the Digital Forensic Labs specific resources.

• Self-evaluate their educational needs and plan remedial action as required,
• Manage their studies using a range of IT,
• Prepare coursework without recourse to plagiarism by fully acknowledging the contribution made by the work or ideas of others,
• Work in accordance with University Health and Safety policy.

• Dr Graeme Horsman

The aim of this module is to provide students a thorough grounding in the fundamentals of common digital systems, the artefacts associated with such systems and techniques to identify, collect and analyse those artefacts. A mixture of theory and practice will facilitate the development of skills and experience across multiple computing platforms, including networking related artefacts. In addition to preparing students for real-world examination of computers, these skills will serve as a foundation for further study, including the Mobile Device Forensics and Internet-Based Investigations modules.

Week 1:

• Binary Data Structures and Encoding,
• File Formats,
• Disks Basics & Advanced Concepts,
• FAT & NTFS File Systems,
• Windows Forensics,
• Metadata & Carving,
• Analysis Techniques.

Week 2:

• Other File Systems,
• Virtual Machines,
• Windows Enterprise Systems,
• Linux Forensics,
• macOS Forensics,
• Memory Forensics,
• OSINT Investigation,
• Cryptography and Encryption,
• Cybersecurity & Malware.

On successful completion of this module you will be able to:

• Given detailed knowledge of computer hardware, justify appropriate data acquisition strategies,
• Recover digital evidence at different levels of abstraction from digital systems, both volatile (e.g. network and memory) and non-volatile (e.g. file systems, operating systems, applications),
• Evaluate the reliability of digital evidence recovered from digital systems,
• Given a set of instructions for a case, construct and carry out an appropriate strategy to recover appropriate and admissible digital evidence,
• Create appropriate documentation to accompany a digital forensic investigation (e.g. notes and expert reports).

• Dr Graeme Horsman

The aim of this module is to develop knowledge and understanding of the processes involved in the investigation of digital crime. These include the investigation of digital crime, the organization of digital systems, the seizure of digital evidence, the principles of device examination, the value of contemporaneous notes, the construction of reports and knowledge of relevant law.

• Introduction to Digital Forensics
• Legislation,
• Handling Evidence,
• Quality in Digital Forensics,
• Digital Forensics Documentation e.g. notes, continuity and statements,
• Computer Architecture,
• Mobile Architectures,
• Other Digital Devices,
• Forensic Tools,
• Disk Imaging,
• Phone Extraction,
• Hashing Evidence,
• Analysis Techniques,
• Live Examination & Triage.

• Explain selected fundamental technologies, techniques, processes, standards, and legislation applicable to digital forensics,
• Construct an effective search and seizure plan for a digital investigation,
• Perform a forensically sound acquisition of digital evidence,
• Perform an examination of a digital evidence source using common techniques,
• Create appropriate documentation to accompany a digital forensic investigation (e.g. notes, continuity, and statements).

• Dr Graeme Horsman

This module addresses various Internet based technologies and services, the artefacts that are associated with them and the analysis of the various parts of such internet/network connected systems, from servers and cloud services to computers and mobile devices.

• Introduction to Networks & Internet,
• Internet Services,
• Web & Web Services,
• Email Analysis,
• Web Server Analysis,
• Web Browser Analysis,
• Social Media,
• Dark Web,
• Chat Services,
• File Sharing & Peer to Peer.

• Construct a clear explanation of the design and implementation of networks, the Internet, and internet-based services,
• Analyse the digital forensic artefacts left by web browsers, web servers, and other internet-based applications,
• Interpret the artefacts left by internet-based applications through experimentation.

• Dr Graeme Horsman

The tools used in digital forensics may not extract all relevant data or interpret data comprehensively. This module arms students with the understanding and ability to use programming techniques for the identification, extraction and interpretation of data in a digital forensics context.

• Introduction to Python,
• The Atoms of Programming,
• Syntax and Vocabulary,
• Sequences and Loops,
• File Handling and File Systems,
• Text Processing,
• Binary Processing,
• SQLite,
• Timestamps,
• Dictionaries,
• JSON,
• XML,
• 3rd Party Python Modules.

• Apply software development techniques to solve a problem in a digital forensic context,
• Develop, implement, and document an appropriate test strategy for a programmatic solution to a digital forensics problem,
• Write appropriate supporting documentation for a program that performs a digital forensics task,
• Defend design decisions and implementation solutions made during the development of a programmatic solution to a digital forensics problem.

• Dr Graeme Horsman

This module introduces the techniques and challenges encountered in the forensic examination of mobile devices. Students will learn about various technologies associated with mobile devices, procedures for preserving, collecting and analysing data, as well as related legal and procedural concerns. The module concentrates on the Android and iOS operating systems but includes an overview of other mobile and embedded devices, including non-smart phones and IoT technologies.

• Legislation and Procedures,
• Evidence Seizure and Preservation,
• Network History and Technologies,
• SIM Cards - Theory and Analysis,
• Mobile Technologies and Artefacts,
• iOS and Android - Smart Devices,
• 'Dumb' Phones,
• Call Data Records and Cell Site Analysis,
• Backups and Cloud-based Evidence,
• Advanced Extraction Techniques,
• Other Mobile Devices & Trends.

• Construct a clear explanation of the technologies involved the result in the creation of mobile device evidence,
• Select and perform appropriate techniques for the preservation and acquisition of mobile device evidence,
• Select and perform appropriate techniques for the examination and interpretation of mobile device evidence. 

• Dr Hannah Moore

To understand the core responsibilities of evidence recording and collection at the crime scene, both in general, and specifically related to operational constraints of a UK investigative context. To understand the operation of forensic and police investigators within the context of a major investigation.

• Role of the CSI,
• Scene approach,
• Volume and major crime scenes,
• Recording the scene,
• Photography of the crime scene,
• Search and location of evidence,
• Evidence recovery techniques,
• Evidence integrity and contamination issues,
• Evidence evaluation,
• Exhibiting and packaging,
• ISO 17020.

On successful completion of this module you will be able to:

• Analyse various different strategies of volume and major scene investigation to consider the effects of different approaches.
• Compare the range of evidence collection and investigation techniques available to the crime scene investigator.
• Evaluate the relative merits of the range of systematic crime scene procedures vital to successful investigations.
• Evaluate which of these procedures are appropriate to a particular crime scene and apply these procedures appropriately during a crime scene exercise.
• Create a crime scene report which objectively critiques the methodologies used and draws justified conclusions appropriate for the evidence.

• Roland Wessling
• Dr Kate Hewins

The module will provide an understanding of the role and responsibilities of expert witnesses in domestic and international criminal and civil cases and how they can present their evidence to the court effectively. You will also apply knowledge gained in previous modules to strengthen arguments presented in expert witness reports.

• Role and legal responsibilities of the forensic expert,
• Civil and criminal procedure rules,
• Excellence in report and statement writing,
• Presentation of evidence in court,
• Preparation for examination-in-chief and cross-examination.

On successful completion of this module you will be able to:

• Compare and contrast between the various legal systems and the concepts of criminal prosecution and civil litigation,
• Evaluate and compose in the role and with the responsibilities of an expert witness,
• Construct, formulate and appraise an effective expert witness report in compliance to legal requirements for such a document,
• Construct a case to present oral evidence in court effectively and respond successfully to cross-examination, with an insight into how cross-examination is prepared.

• Dr Graeme Horsman

The aim of the project is to give the student an opportunity to solve a practical Digital Forensics problem using appropriate theory, concepts, methods, processes, tools and skills gained during the module study phase.

• A ‘project skills’ day covering literature reviews, referencing, methodology and experiments in digital forensics, and other related topics,
• Regular meetings with your project supervisor.

• Critically evaluate current existing research in a specific area of digital forensics,
• Construct and justify an appropriate plan and research methodology for a digital forensics research project,
• Conduct experiments or apply other digital forensic principles, techniques, or theories in the context of digital forensics research,
• Evaluate the methods, experiments, techniques, and results in the context of digital forensic science,
• Produce a dissertation that presents the research in a concise, clear, well-presented manner,
• Defend the methodology and results in an oral examination.