IMT4130 - Cybercrime Investigation


Examination arrangement

Examination arrangement: Aggregate score
Grade: Letter grades

Evaluation Weighting Duration Grade deviation Examination aids
School exam 51/100 3 hours D
Home examination 49/100 6 hours

Course content

-Digital Forensics Ontology -Cyber Investigation Process -Cyber Law -Internet investigation -Automation and virtualization -Anonymity, Dark Nets and forensics -IoT forensics -Cloud forensics -Cryptocurrency forensics -Memory forensics -Multimedia forensics -Anti-forensics and Anti-anti-forensics -Guest lectures, as for example: Investigation law, Embedded device forensics -Laboratory to forensic case scenarios, investigation report

Learning outcome

Knowledge: -Candidates develop deep understanding in the methodology, technology and application of digital forensics in cybercrime investigation. -Candidates are expected to reach an advanced level of knowledge in the broad spectrum of digital evidence, analysis methods and tools. -The course is oriented towards profound theoretical background, where the students learn contemporary techniques, best practices, and advanced topics. -The course also includes hands-on exercises and lab work to apply and test techniques and best practices.

Skills: -Candidates are capable of analyzing existing theories, methods and interpretations in the field of digital forensics and working independently on solving theoretical and practical problems related to cybercrime investigation. -Candidates can use relevant methods in independent studies and development in digital forensics. -Candidates are capable of performing critical analysis of various literature sources and applying them in structuring and formulating problem-oriented reasoning in cybercrime investigation. -Candidates are capable of carrying out an independent limited study or development project in cybercrime investigation under supervision, following the applicable ethical rules.

General competence: -Candidates are capable of analyzing relevant professional and research ethical problems in cybercrime investigation. -Candidates are capable of applying their knowledge and skills in new fields, in order to accomplish advanced tasks and projects in cybercrime investigation. -Candidates can work independently and are familiar with terminology of cybercrime investigation. -Candidates are capable of discussing professional problems, analyses and conclusions in the field of digital forensics, both with specialists and with general audience. -Candidates are capable of contributing to innovation and innovation processes.

Learning methods and activities

-Video lectures -Interactive sessions -Articles -Lab work -E-learning -Group work -Students may work on a research report (term paper) individually or in groups throughout the semester

Local participation in two lab sessions, each session will be two full days locally at Campus Gjøvik

Compulsory assignments

  • Obligs - individual
  • Oblig-required local participation in two lab sessions
  • Obligs group work

Further on evaluation

The course includes small and large assignments based on forensic challenges, lab work reports, presentation of results, and group work. There will be both individual assignments and group assignments (Oblig) with predefined groups, where the delivery will be through reports.

Oblig-required local participation in two lab sessions, each session will be two full days locally at Campus Gjøvik

The total number of assignments and the type of assignments within Oblig, will be given at the start of the semester. The different assignments will be pass/no pass, and all assignments with a deadline before the exam must be passed/approved to be allowed to take the following exam.

There will be two exams. One (written school exam) with theoretical questions in the middle of the semester (51/100), and one at the end of semester with both theoretical questions and practical tasks (home exam) (49/100). Both exams will be graded A-F.

In the case of a re-take of any of the individual elements (Oblig), the student is required to re-take the entire course.

Re-sit for the written exam in August, might be changed from written to oral. No re-sit for the home exam. If the student has passed the written exam, only the home exam need to be retaken next time the course is running. If not passed the written exam, both assessment parts need to be taken up again.

General retake: Both assessments parts need to be taken up again (both parts need to be passed in the same semester).

Specific conditions

Admission to a programme of study is required:
Information Security (MIS)
Information Security (MISD)
Information Security (MISEB)

Required previous knowledge

Passed IMT4114 Introduction to Digital Forensics or IMT4012 Digital Forensics 1 or IMT4009 Digital Forensic Methodology is required.

Exceptions at the discression of the Course responsible for students with passed modules from PHS's NCFI (The Norw Police Academy).

Course materials

The following textbook is the primary reference: “Cyber Investigation”, André Årnes ed., Wiley. Additional sources, e.g. presentation material, forensics lab resources, and up to 12 selected papers will be provided during the course.

Credit reductions

Course code Reduction From To
IMT4022 7.5 AUTUMN 2017
More on the course



Version: 1
Credits:  7.5 SP
Study level: Second degree level


Term no.: 1
Teaching semester:  SPRING 2024

Language of instruction: English

Location: Gjøvik

Subject area(s)
  • Information Security
Contact information
Course coordinator: Lecturer(s):

Department with academic responsibility
Department of Information Security and Communication Technology


Examination arrangement: Aggregate score

Term Status code Evaluation Weighting Examination aids Date Time Examination system Room *
Spring ORD School exam 51/100 D 2024-04-10 09:00 INSPERA
Room Building Number of candidates
SL415 Sluppenvegen 14 10
M413-Eksamensrom 4.etg Mustad, Inngang A 0
M433-Eksamensrom 4.etg Mustad, Inngang A 19
Spring ORD Home examination 49/100





Room Building Number of candidates
Summer UTS School exam 51/100 D INSPERA
Room Building Number of candidates
  • * The location (room) for a written examination is published 3 days before examination date. If more than one room is listed, you will find your room at Studentweb.

For more information regarding registration for examination and examination procedures, see "Innsida - Exams"

More on examinations at NTNU