Course content

• Cyber Investigation Process
• Cyber Law
• Internet investigation
• Anonymity, Dark Nets and forensics
• IoT forensics
• Multimedia forensics
• Anti-forensics and Anti-anti-forensics
• Forensic case scenarios and investigation report

Learning outcome

Knowledge:

• The candidate possesses a deep understanding in the methodology, technology and application of digital forensics in cybercrime investigation.
• The candidate possesses an advanced level of knowledge in selected areas of the broad spectrum of digital evidence, analysis methods and tools.
• The candidate understands the theoretical background of forensics investigations.
• The candidate knows contemporary techniques, best practices, and advanced topics.
• The candidate knows how to handle hands-on forensic exercises and lab work, and how to apply and test techniques and best practices.

Skills:

• The candidate is capable of analyzing existing theories, methods and interpretations in the field of digital forensics.
• The candidate is cabpable of working independently on solving theoretical and practical problems related to cybercrime investigation.
• The candidate is able to use relevant methods in independent studies and development in digital forensics.
• The candidate is capable of performing critical analysis of various literature sources and applying them in structuring and formulating problem-oriented reasoning in cybercrime investigation.
• The candidate is capable of carrying out an independent limited study or development project in cybercrime investigation under supervision, following the applicable ethical rules.

General competence:

• The candidate is capable of analyzing relevant professional and research ethical problems in cybercrime investigation.
• The candidate is capable of applying their knowledge and skills in new fields, in order to accomplish advanced tasks and projects in cybercrime investigation.
• The candidate is able to work independently and is familiar with terminology of cybercrime investigation.
• The candidate is capable of discussing professional problems, analyses and conclusions in the field of digital forensics, both with specialists and with general audience.
• The candidate is capable of contributing to innovation and innovation processes.

Learning methods and activities

• Video lectures
• Guest live/video lectures
• Interactive sessions
• Article reading
• Lab work
• Group work
• Students may work on research report (term paper) individually or in groups throughout the semester

Compulsory assignments

• Praktical group assignment/presentation
• Practical assignment

Specific conditions

Required previous knowledge

Passed IMT4114 Introduction to Digital Forensics or IMT4012 Digital Forensics 1 or IMT4009 Digital Forensic Methodology is required.

Exceptions at the discression of the Course responsible for students with passed modules from PHS's NCFI (The Norwegian Police Academy).

Course materials

The following textbook is the primary reference: Cyber Investigations: A Research Based Introduction for Advanced Studies, André Årnes ed., Wiley, 2022. Additional sources, e.g. presentation material, forensics lab resources, and up to 10 selected papers will be provided during the course.

Credit reductions