Course content

• Digital investigations and stakeholders roles.
• Digital evidence: acquisition, admissibility, and authenticity.
• Chain of custody, evidence integrity and forensic soundness.
• File system and live system forensics.
• Timeline analysis and event reconstruction.
• Internet and network forensics.
• Forensic tools and automation.
• Reporting and presenting findings.
• Expert witness role and cybercrime law.
• Computational forensics.
• Use of machine learning in digital forensics.
• Forensic readiness and proactive measures.
• Selected advanced topics (if time permits).

Learning outcome

After successfully completing the course, the students have obtained the following learning outcomes:

Knowledge:

• The candidate possesses thorough understanding of digital forensics methodology and the requirements for collecting, preserving, and documenting digital evidence in a manner that ensures integrity and admissibility.
• The candidate has good understanding of the requirements for maintaining evidence integrity and chain of custody, including secure storage, proper documentation, and compliance with legal and procedural standards throughout the investigation process.
• The candidate has insight into principles, procedures, and core concepts of forensic standards and best practices, including the importance of validating and testing forensic tools to ensure reliability and accuracy.
• The candidate possesses knowledge of the overall process for establishing and maintaining a digital forensic lab environment, including requirements for infrastructure, security controls, and compliance with organisational and legal guidelines.
• The candidate has good understanding of the role of expert witnesses and how digital evidence is presented, evaluated, and challenged in legal proceedings.
• The candidate possesses knowledge of policies, standards, and guidelines for implementing forensic controls and understands their role in ensuring proper evidence handling, documentation, and reporting in digital forensic investigations.
• The candidate has good understanding of legal, privacy, and ethical considerations in digital forensic investigations, including data protection obligations and responsible handling of sensitive information.

Skills:

• The candidate is able to perform forensic acquisition of digital evidence from computer and network media using appropriate tools and procedures.
• The candidate is capable of applying live system forensic techniques and evaluate the order of volatility to prioritise evidence collection.
• The candidate is able to conducting evidence analysis, including timeline analysis and reconstruction of events, based on acquired data.
• The candidate can produce clear and scientifically structured documentation of forensic acquisition and analysis processes.
• The candidate is able to apply forensic principles when working with practical examples and scenarios relevant to digital investigations.
• The candidate is capable of performing basic stakeholder analysis, risk assessment, and forensic triage in limited and well-defined contexts.
• The candidate can assess the suitability of forensic methods and tools for specific investigative scopes and organisational policies.

General competence:

• The candidate is capable of analysing business, legal, ethical, and case-specific requirements when planning and conducting a digital forensic investigation.
• The candidate has developed competence in understanding forensic analysis and incident response processes and their interdependencies.
• The candidate can work independently and demonstrates familiarity with digital forensics terminology and concepts.
• The candidate is able to communicate and discuss professional challenges such as documentation, decision-making, implementation plans, and corrective actions with forensic experts, IT specialists, and managers.
• The candidate has developed learning skills to acquire new knowledge and techniques in a self-directed manner.
• The candidate can contribute to innovative approaches and improvements in digital forensic practices.
• The candidate is able to actively participate and collaborate effectively within a group setting.

Learning methods and activities

• Lectures.
• Group work.
• Laboratory work.
• Guest lectures.
• Asynchronous e-learning (recorded lectures and materials).
• Other exercises (if time permits).

Additional information:

• The course offers flexibility for both on-campus and remote students. Lectures will be conducted in person on the Gjøvik campus and will be streamed/recorded to remote students.
• Lectures and other types of learning material, such as recordings of lectures, will be offered through our Learning Management System (LMS), i.e. Canvas.
• Communication between the teachers and the students, and among the students, will be facilitated by the LMS.
• Completion and submission of mandatory group assignments (approved/not approved) and a final written deliverable are required. The group work culminates in a document with an academic structure similar to a scientific article. Specific requirements for these assignments and deliverable will be communicated to students through the LMS.
• If individual participation and contributions within a group are uneven, or if some students do not complete their assigned tasks, the course coordinator may take corrective actions. This could include evaluating individual performance separately, which may result in individual grades for the group work component.
• Laboratory sessions will be conducted on-campus at the Gjøvik campus to provide hands-on experience. Students who attend remotely are not required to be physically present for these sessions. All sessions will be streamed and recorded to ensure full accessibility for remote participants.

Compulsory assignments

• Mandatory group assignment

Specific conditions

Recommended previous knowledge

Students should ideally have some technical background to get most of out this course. Experience in areas such as programming, operating systems, network communication, databases, and basic IT concepts will be helpful. These skills can come from previous studies, professional experience, or practical training, but they are not mandatory for participation.

Course materials

Coursebook: Årnes, André, ed. Digital forensics. John Wiley & Sons, 2017.

Other learning material such as conference/journal research articles, (guest) lectures, and other supplementary materials are available via LMS.

Credit reductions