CIS 272 - Digital Forensics I

5.0 Credits
Covers basic procedures and methodologies for digital forensics that must be mastered. Acquisition, identification, and analysis of evidence; documentation strategies; manual and automated analysis tools; and working as an expert witness. Maps to the ACE and CSFA certifications.
Prerequisite CIS 125 and CIS 151 or concurrent enrollment, or instructor permission.
Course-level Learning Objectives (CLOs)
Upon successful completion of this course, students will be able to:

Describe the layout of various disk structures, to include master boot records, boot records, partition tables, and GUID partition tables.
Demonstrate the ability to create forensic quality copies of storage media.
Demonstrate the ability to acquire evidence from a running computer in a forensically sound manner.
Describe the hardware and software requirements for a basic forensic workstation.
Demonstrate the ability to use a variety of forensic software and hardware tools to recover deleted and residual data.
Describe the overall approach and process used to conduct computing investigations in an enterprise environment.
Discuss a code of ethics and conduct related to the information security and digital forensics professions.