This course will introduce and study the main concepts of digital forensics analysis. Computer Forensic Analysis requires good tools, and solid critical thinking skills. A good understanding of the forensics media is a prerequisite for constructing compelling and plausible conclusions. Data has to be correlated carefully, to make accurate and compelling claims about a computers’ behavior. Critical thinking has to be practiced to understand the underlying problem, to collect relevant information (data), and to apply theory and concepts to make inferences through analysis in order to construct forensic conclusions without reasonable doubt.

One of the central questions in this class is “How and where is data stored on storage media?” In answering this question, this course will provide students with the knowledge needed to assess and re-construct usage on a device. This course will discuss search and seizure procedures, data storage methods, recognizing primary and extended partitions, reading file allocation tables, methods to recover deleted files, and sound digital forensics best practices.

Sahar Mardani
Email : MardaniS5877@UHCL.edu
TA hours: Posted on TA's website .

In this course, a 'student-centered' approach will be emphasized instead of the traditional teacher-centered approach. Students are expected to attend all classes, read related material and notes before class, work homework exercises, and participate in class discussion, problem solving and laboratory experiments

The University of Houston-Clear Lake and its staff are here to help students learn and achieve their academic goals.  The instructor is expected to be prepared, to be punctual, to conduct appropriate classroom activities such as delivering lectures and promoting classroom discussions, to keep students informed of any changes in the course, to assist students generally in their efforts to learn the course material, and to evaluate student performance on assignments, on exams, and for the course as a whole.

The student is expected to be on time, to be prepared to participate in classroom activities and to make use of all available resources in order to learn about the topics covered in the course.  Students should be conscientious and punctual about attending classes, reading the textbook and handouts, submitting assignments, taking notes, asking questions, studying the material, and preparing for examinations.  Students should be self-reliant, honest, and courteous.  If the student has any difficulties, problems, or conflicts, she/he should communicate with the instructor or the teaching assistant.  If the teaching assistant is not responsive or helpful, students should contact the instructor for assistance.  If the instructor is not responsive or helpful, students should contact the division chair.

There are three assessment activities (AA) of critical thinking in the course. The evaluation of these activities is used to assess how well critical thinking is incorporated into the course. These assessments will be used as input to the UHCL Critical Thinking database for internal assessment of Critical Thinking, and will not affect your grade of the course.

The three ACT SLOs are assessed by the following assignments:

SLO ACT #1: HW #2 :  Answer questions on forensically sound procedures and the admissibility of information in a court of law. This homework requires the students to have a precise conceptual understanding of the purpose in collecting evidence in a forensically sound manner.
SLO ACT #2: HW #4 :  Completing a worksheet that converts information from decimal to binary to hexadecimal values and converting bytes to KB, MB, GB and TB. Students will have to use their knowledge of number systems to precisely covert values from decimal number systems to a binary and hexadecimal number system and vice versa.
SLO ACT #5: HW #7 :  Use FTK Imager to analyze a FAT32 image. Students will look at an image and retrieve evidence. This homework requires students to have a precise understanding of how system and user information is stored on devices.

The instructor will assign a grade to the three assignments above by the quality, relevance and accuracy of the submitted works by comparing them to model solutions. Assessment results are tabulated by:
 
Excellent: 90% - 100%
Acceptable: 70% - 89%
Unacceptable: 0% - 69%

Overall, the course primarily assesses connection out of the four c’s of the UHCL ACT Guideline.

There will be several labs that will be done in class, and also as homework assignments. The exams will also have lab components incorporated.

Assessment and Grading Criteria

The following conversion scale will be used between the numeric and letter grades:

University Academic Honesty Policy: All UHCL students are responsible for knowing the standards of academic honesty. Please refer to the UHCL catalog and the student Life Handbook for the University Academic Honesty Policy. Plagiarism, that is, using research without citations, or using intellectual property without crediting the sources, will result in failure of the course. See the UHCL academic honesty policy for details.

Academic Integrity: Each student is expected to maintain the highest standards of honesty and integrity in academic and professional manners. The University reserves the right to take disciplinary action, up to and including dismissal, against any student who is found guilty of academic dishonesty or otherwise fails to meet these standards.

Access to Education: Qualified students with disabilities needing appropriate academic adjustments should contact the instructor as soon as possible to ensure your needs are met in a timely manner. For information on assistive technology available for student use and additional information on services available through Coordinator of Health Disabilities Services, Bayou 1402, telephone 281-283-2627. If you will require special academic accommodations, as specified by the Americans with Disabilities Act, please contact the Disability Services Office at 281-283-2627.

Collaboration: Collaborative work, such as studying or discussing course assignments and materials with other class members is encouraged.

Changes in Syllabus: The instructor may make necessary revisions of the syllabus. It is the student's responsibility to keep informed of any changes. All changes will be posted on the website.

Copyright: All materials in this course fall under copyright laws and should not be downloaded, distributed, or used by students for any purposes outside of this course.

6 Drop Rule: Students who entered college for the first time in Fall 2007 or later should be aware of the course drop limitation imposed by the Texas Legislature.  Dropping this or any other course between the first day of class and the census date for the semester/session does not affect your 6 drop rule count.   Dropping a course between the census date and the last day to drop a class for the semester/session will count as one of your 6 permitted drops.  You should take this into consideration before dropping this or any other course. Visit www.uhcl.edu/records for more information on the 6 drop rule and the census date information for the semester/session.

Other UHCL Policies : UHCL General Program Requirements on Withdrawals, Appeals, GPA, Repeated Courses etc. can be found at http://www.uhcl.edu/XDR/Render/catalog/archives/125/06/.