INFR 4690U – IT Forensics

In this course, students will learn how to create an incident response plan and implement a computer forensics incident-response strategy, and conduct a proper computer forensics investigation. This course is composed of five parts: 1) basics, which includes the brief introductions of needed knowledge for this course, such as File System Structures and Metadata, FAT/NTFS/Ext2/Ext3 File System Essentials, Imaging digital media, TCP/IP and networking fundamentals, system administration basics, and information-hiding techniques; 2) computer forensics and investigation, which introduces how to conduct a proper computer forensics and investigation; 3) incident response, which introduces how to create an incident response plan and implement a computer forensics incident response strategy; and 4) case studies, which are completed in teams and one team per case will present their analysis and solution to the class (e.g. in PowerPoint) as it would be done as investigators.
Credit hours: 3
Lecture hours: 3
Laboratory hours: 3
Prerequisite(s): INFR 2421U and INFR 3600U and INFR 3610U