Instructor: Philip Cupina

Cell Phone: 789-4731

Office: RGC1 Rm. 117

Office Hours: TTh 5:30-6:00 PM  and by appointment.

E-mail: pcupina@austincc.edu         

Course Description:

This course will progress through what a typical computer forensics analyst performs during an investigation. We will be covering hardware, files systems, advanced EnCase concepts, file signature and hash analysis.

Pre-requisite:

Approved Course Text:

EnCE The Official EnCase Certified Examiner study guide

Steve Bunting, EnCE, CCFT

ISBN- 978-0-470-18145-4

Instructional Methodology:

The course will have both lab and lecture.

Course Rational:

To instruct the student in proper computer data investigations using the proper methods and software.

Course Objectives/
Learning Outcomes

At the completion of this course, the student will have demonstrated the ability to:
Understand File Systems:
Know how to acquire digital evidence
Perform searches on data
Understand Hash analysis
Clearly demonstrate file signature analysis
Create and maintain an accurate case
 

Exams:

There will be 3 exams and when averaged will make up 80% of total grade. The homework assignments will make up 10% of total grade and the labs will make up the remaining 10%. There are no Make-up exams given. All Homework and assignments are due on the day posted unless prior arrangements have been made with the instructor.

Grading example:   3 Exam average is 88.8%. Homework average is 95%.  Lab average is 98%.   88.8*(.8) = 71.04:  95*(.1)= 9.5: 98*(.1)=9.8.  You then add 71.04+9.5+9.8=  90.34% or an A.

Grades Policy:

Grades will be based both on concepts and practical application.

Grade Scale:

A = 90 - 100
B = 80 - 89
C = 70 - 79
D = 60 - 69
F = below 60 

Course/Class Policies:

Attendance/
Withdrawal:

Students are expected to attend classes and will be held responsible for all material covered in class. Regular attendance helps ensure satisfactory progress towards completion of the course. It is the student's responsibility to complete a withdrawal form in the Admissions Office if they wish to withdraw from this class. The instructor may withdraw students from this class if their absences exceed 10% of the total number of class meetings. The last date to withdraw for this semester is July 11. It is not the responsibility of the instructor to withdraw the students from their class even though the instructor has the prerogative to do so under the above listed circumstances.

Incomplete:

A student may receive a temporary grade of "I" (Incomplete) at the end of the semester only if ALL of the following conditions are satisfied:

·  The student is unable to complete the course during the semester due to circumstances beyond their control.

·  The student must have earned at least half of the grade points needed for a "C" by the end of the semester.

·  The request for the grade must be made in person at the instructor's office and necessary documents completed.

·  To remove an "I", the student must completed the course by two weeks before the end of the following semester. Failure to do so will result in the grade automatically reverting to an "F".

Academic Integrity:

Acts prohibited by the college, for which discipline may be administered, are scholastic dishonesty (including but not limited to cheating on an exam or quiz), plagiarizing, and unauthorized collaboration with another in preparing outside work. Academic work submitted by students shall be the result of their thought, research or self-expression. Academic work is defined as, but not limited to, tests and quizzes (whether taken electronically or on paper); projects, (either individual or group); classroom presentations, and homework.

Freedom of
Expression:

It is expected that faculty and students will respect the views of others when expressed in classroom discussions.

Students with Disabilities Policy:

Each ACC campus offers support services for students with documented physical or psychological disabilities. Students with disabilities must request reasonable accommodations through the Office for Students with Disabilities on the campus where they expect to take the majority of their classes. Students are encouraged to do this three weeks before the start of the semester. (Refer to the Current ACC Student Handbook.)

Scan

C5

Acquires and evaluates information

2

Competencies:

C6

Organizes and maintains information

2

C7

Interprets and communicates information

2

C8

Uses computers to process information

2

C9

Participates as a member of a team: Contributes to group effort

2

C16

Monitors and corrects performance: Distinguishes trends, predicts impacts on system operations, diagnoses systems performance, and corrects malfunctions

1

C17

Improves or Designs Systems: Suggests modifications to existing systems and develops new or alternative systems to improve performance

1

C18

Selects technology: Chooses procedures, tools, or equipment, including computers and related technologies

2

C19

Applies technology to task: Understands overall intent and proper procedures for setup and operation of

2

C20

Maintains and troubleshoots equipment: Prevents, identifies, or solves problems with equipment, including computers and other technologies

2

F1

Reading: Locates, understands, and interprets written information in prose and in documents such as manuals

2

F3

Arithmetic: Performs basic computations; uses basic numerical concepts such as whole numbers, etc.

2

F5

Listening: Receives, attends to, interprets, and responds to verbal messages and other cues

2

F9

Problem solving: Recognizes problems and devises and implements plan of action.

1

F10

Seeing Things in the Mind’s Eye: Organizes and processes symbols, pictures, graphs, objects and other

2

F11

Knowing how to learn: Uses efficient learning techniques to acquire and apply new knowledge and skills.

2

F12

Reasoning:  Discovering  a rule or principle underlying the relationship between two or more objects and applies it

2

F13

Responsibility Exerts a high level of effort and perseveres towards goal attainment

2

F14

Self-Esteem: Believes in own self-worth and maintains a positive view of self.

2

F15

Social ability: Demonstrate understanding, friendliness, adaptability, empathy, and politeness in group settings.

2

F16

Self-Management:  Assesses self accurately, sets personal goals, monitors progress, and exhibits self-control.

2

F17

Integrity/Honesty:  Chooses ethical courses of action.   

2

AustinCommunity College
Computer Information Systems

Instructor: Philip Cupina
Computer System Forensics

ITSY 2343

Book:  EnCE The Official EnCase Certified Examiner study guide

Steve Bunting, EnCE, CCFT

ISBN- 978-0-470-18145-4

Week 1

May 24, 26

Introduction to the course
Explanation and Discussion of Syllabus

Fill out Computer Studies Student Information Form

Lecture Windows Forensics

Lecture chapter 1 Computer Hardware

Read Chapter 1,2
 

Week 2

May 31, June 2

Chapter 2, File Systems, Chapter 3 First Response

Lab #1

Read Chapter 3,4

Turn in Homework

Week 3

June 7, 9

Lecture:  Chapter  4: Acquiring Digital Evidence

Review for Exam #1 Chapters 1-4.

Lab #2

Read Chapter 5

Turn in Homework

Week 4

June 14, 16

Exam #1 Chapters 1-4 (Tuesday)

Lecture: Chapter 5  EnCase Concepts

Lab # 3

Read Chapter 6,7

Turn in Homework

Week 5

June 21, 23

Chapter 6  EnCase Environment 

Chapter 7 Understanding, Searching For, and Bookmarking Data

Lab #4

Read Chapter 8

Turn in Homework

Week 6

June28, 30

Lecture: Chapter 7 Understanding, Searching For, and Bookmarking Data Cont.

Review for Exam #2 Chapters 5-7.

Lab #5

Review Chap 1-4

Turn in all labs

Read Chapter 8

Week 7

July 5, 7

Exam #2  Chapters 5-7 (Tuesday)

Lecture: Chapter 8 File Signature Analysis and Hash Analysis

Read Chapter 9

Turn in Homework

Week 8

July 12,14

Chapter 9 Windows Operating System Artifacts

Chapter 10 Advanced EnCase

Lab #6

Read Chapter 9,10

Turn in Homework

Week 9

July 19, 21

Exam #3 Chapters 8-10 (Tuesday)

Review of Exam