Digital Forensics

Durée

30h Th, 12h Labo., 30h Proj.

Nombre de crédits

Enseignant

Benoît Donnet, Laurent Mathy

Langue(s) de l'unité d'enseignement

Langue anglaise

Organisation et évaluation

Enseignement au deuxième quadrimestre

Horaire

Horaire en ligne

Unités d'enseignement prérequises et corequises

Les unités prérequises ou corequises sont présentées au sein de chaque programme

Contenus de l'unité d'enseignement

On one hand, a Digital evidence refers to any probative information stored or transmitted in digital form that a party to a court case may use at trial (e.g., emails, digital photos, ATM transaction logs, databases backups, ...).  On the other hand, digital forensics is a branch of forensic science concerned with the proper acquisition, preservation, and analysis of digital evidence, typically after an unauthorized access or use has taken place.  Digital forensics follows the goal to explain the current state of a digital artifact.
This course aims at providing a first look at digital forensics, in particular focusing on network forensics (i.e., monitoring and analyzing network traffic), computer data forensics (i.e., flash, HDD, USB device), and mobile devices forensics (i.e., collect digital evidence from mobile devices).
Table of Content:
Part 0: Administrative Details (B. Donnet + L. Mathy)
Part 1: Digital Forensics Methodology (B. Donnet)

• Chap. 1: Generalities
• Chap. 2: Sources of Evidences
• Chap. 3: Evidence Acquisition

• Chap. 1: Deep Web
• Chap. 2: Email Forensics
• Chap. 3: Traffic and Packet Analysis
• Chap. 4: Wireless and Mobile Network Investigation

• Chap. 1: File System Forensics
• Chap. 2: FAT File System

Acquis d'apprentissage (objectifs d'apprentissage) de l'unité d'enseignement

Upon completing this course, students are expected to:

• understand the basics of computer data and network forensics
• acquire hands-on practice on digital forensics investigation
• be prepared for active research at the forefront of this area.

Savoirs et compétences prérequis

Students are supposed to have a good knowledge of basic Computer Networking (INFO0010 or assimilated) and of basic Operating Systems (INFO0940 or assimilated).
It is not required to have any knowledge in Computer Security

Activités d'apprentissage prévues et méthodes d'enseignement

The course is organized as follows

• Lectures (30hours) describing in details the theoretical and practical aspects of the course
• Lab sessions (10h) to be done individually.  Each lab ends with a small report to complete (a simple text file to fill in with answers).
• Assignments in teams of 2 students. 

Mode d'enseignement (présentiel, à distance, hybride)

If possible, face-to-face lectures will be organized, in addition to lab sessions and assignments (carried out remotely).
According the CoVID19 pandemia evolution, it is still possible that the course will be reorganized remotely (WebEx/Collaborate virtual classes, podcast, ...)
The course is entirely given in English.

Adaptations organisationnelles liées au contexte sanitaire

Lectures recommandées ou obligatoires et notes de cours

Slides, as well as assignments and labs subjects, are available on the course Web Site.
The course has been built based on those books:

• E. Casey.  Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet.  3rd Edition, Academic Press.  May 2011.
• R. C. Neuman.  Computer Forensics: Evidence Collection and Preservation.  EC Council Press.  2010.
• S. Davidoff, J. Ham.  Network Forensics: Tracking Hackers Through Cyberspace.  Prentice Hall.  May 2012.
• M. Robinson.  Digital Forensics Workbook: Hands-on Activities in Digital Forensics.  WorkBook Edition.  October 2015.
• B. Carrier.  File System Forensic Analysis.  Ed. Addison-Wesley.  2005.
• N. A. Mikus.  An Analysis of Disc Carving Techniques.  MS Thesis.  Naval Postgraduate School.  2006.  See https://calhoun.nps.edu/bitstream/handle/10945/2219/05Mar_Mikus.pdf?sequence=1
• D. Farmer, W. Venema.  Forensic Discovery.  Ed. Pearson Education.  2009.  Chapter 5.  
• A. Hoog.  Android Forensics: Investigation, Analysis, and Mobile Security for Google Android.  Ed. Syngpress.  June 2011.
• M. K. Bergman.  The Deep Web: Surfacing Hidden Value.   White Paper.
• T. V. Lillard, C. P. Garrison, C. A. Schiller, J. Steele.  Digital Forensics for Network, Internet, and Cloud Computing. Ed. Elsevier.  2010 

Modalités d'évaluation et critères

Vous trouverez ci-dessous les modalités d'évaluation envisagées pour les examens en présentiel et à distance ainsi que celle souhaitée en cas de session hybride. En fonction de l'évolution sanitaire, la modalité choisie vous sera communiquée au plus tard un mois avant le début de la session d'examen.

Toutes sessions confondues :

- En présentiel

évaluation orale

- En distanciel

évaluation orale

- Si évaluation en "hybride"

préférence en présentiel


Explications complémentaires:

The evaluation is threefold:

• Labs are evaluated (a simple text file to fill in during/right after the lab with students' answers).  They account for 25% of the final grade.
• Assignments account for 25% of the final grade.
• The oral exam (on the theoretical part of the course) accounts for 50% of the final grade.  Note that the oral exam will require the student to answer to 2 questions (one based on material reviewed by L. Mathy, the other by B. Donnet).

Stage(s)

Remarques organisationnelles

The course is proposed every 2 years (given during Academic Year 2020-2021).
The course is given during the second semester

Contacts

Professors:

• Benoit Donnet (email -- office 1.15/B28)
• Laurent Mathy (email -- office 1.15/B37)

• Gaulthier Gain

Notes en ligne