Digital Forensics

This module introduces the theory and practical elements of digital forensics and serves as the foundation for further digital forensics learning.

The module takes a practical hands-on approach and goes through the basics of digital forensics going from a traditional crime scene to a lab with digital devices, covering the legal and ethical implications and tools to support the process.

Students will learn how to work with digital devices appropriately for use within a digital investigation and will practice working through the initial stages of the digital forensics incident response lifecycle within teams and independently.

Devices, tools, and processes develop over time, these changes will be reflected within the content as appropriate, across the module.

This module builds on the knowledge and skills developed in DFOR5001 and takes the student further through the digital forensics incident response lifecycle, at this stage by working through the analyse process for digital devices using a variety of tools and techniques.

Students will work through the process of analysing digital devices, employing standard workflow processes, critical thinking, and independent & collaborative learning to ensure they develop the vital soft skills needed in the profession, alongside their subject-specific skills.

Digital forensics in an enterprise environment requires professionals to understand the organisation involved as much as standard digital forensics processes. While there can be some overlap in tools used, enterprise environments require knowledge of and skills in networks and tools to capture volatile network artefacts as much as being able to explain technical details to non-technical audiences.

This module looks at enterprise environments and the differences of working through digital forensics incident response in a networked environment rather than a Police crime scene. Students will develop their artefact collection techniques and analysis skills in a network environment.

This module aims to support students in enhancing their understanding, knowledge and skills necessary to conduct critical research in the area of digital forensics using both quantitative and qualitative approaches, including laboratory evaluation, surveys, case studies and action research. It also helps students in developing a critical and practical understanding of digital forensics and the main research methods appropriate for digital forensics. Example research studies from appropriate areas are analysed to obtain an understanding of types of research problems and applicable research methods. The research process includes how a research problem is selected, literature review, selection of appropriate research methods, evidence and data collection and analysis, development of theories and conclusions, and the dissemination of the outcomes. The module exposes students to a variety of research approaches, encourages analysis of research papers and supports students in coming to conclusions concerning directions for MSc projects.

The aim of the project/dissertation is to provide students with the opportunity to carry out a self-managed in-depth study involving design, fact finding, analysis, synthesis and integration of complex ideas which are sometimes based on incomplete and contradictory data or requirements. The project is likely to demonstrate the application of skills acquired from the taught course to the solution to a particular problem or research topic. Normally the project is a self-contained piece of work of considerably greater depth than can be accommodated within a taught module and may reflect and build on the entire breadth of material studied by the student.

While there are a range of types of projects, there are no rigid distinctions between them, as the scope and importance of literature analysis, primary research, and system development can be tailored to fit the needs and interests of individual students and topics. Development projects, research projects and literature study projects are the most common types:

1. Development Project: In a development project, the student is normally expected to produce a working piece of software that serves a particular purpose, meeting a defined set of requirements. In some cases, the product may include self-designed and purpose-built hardware as well as software, for instance an innovative robotic system. The running system itself is normally the major deliverable, and is normally the most important factor in the assessment. However, the requirements analysis, the system design work, and the testing and evaluation of the software - and how they are documented and presented - are also important to the assessment of development projects. The development work should be set in the context of the questions that it should help answer and how it contributes to answering them.

2. Research Project: Research projects normally involve the design and implementation of original empirical research. Students are normally expected to create a research proposal and plan, identify research questions, undertake a literature review, review, select and evaluate data collection and data analysis methods, design and implement empirical research, analyse data and report research outcomes. All research projects are required to be undertaken within, and contribute to, a theoretical framework.

3. Literature Study Project: A project may consist of a literature review alone when it is extensive, strategically significant, rigorously defined and implemented, and includes well-thought-out recommendations and implications. This requires the student to produce a novel and creative analysis that attempts to answer one or more unanswered (or perhaps wrongly answered) research questions. The student is expected to produce a report describing and critically evaluating existing documents and other sources of information, setting them in the context of a clear conceptual framework, and presenting a cogent analysis.

4. Consultancy Project: In a consultancy project, the student is normally expected to produce a consultancy-style report to meet a clearly defined need for a clearly defined client or audience, providing a detailed and sophisticated critical evaluation of existing techniques, approaches or systems, or how to solve a practical problem, with recommendations. The practical consultancy work should be set in the context of how the work can answer more general and scholarly questions.

5. Data Analysis Project: In a data analysis project, the student is expected to evaluate, select and apply computational techniques for data analysis and knowledge extraction, to solve a novel data analysis or knowledge extraction problem, or develop a novel technique for solving a particular data analysis problem, or develop a novel technique for presenting data or statistical information to support a particular human activity. The student is expected to demonstrate and illustrate the application of the technique and evaluate how well it solves the problem.

6. Conceptual Analysis Project: In a conceptual analysis project, the student is expected to develop an analysis on paper of a system or of how to solve a problem. Such projects might involve developing an analysis of a working software system by applying one or more analytical techniques, for example for producing a usability evaluation; or analysing or modelling a process; or producing a notation or technique for describing a particular sort of information that a software system might generate or use; or devising a procedure for tackling a particular class of problem in software development. The student is expected to demonstrate and illustrate the application of the technique and evaluate how well it solves the problem.