CIT 291 - Digital Forensics

Offered WI
Lecture- 2 Lab- 2
3 credit hrs/4 contact hrs
Prerequisite: CIT 100 - Introduction to Operating Systems with “C” or better (2.0 out of a 4.0 scale)
This course surveys the technical knowledge of the Windows operating system that any digital forensic analyst should know to examine digital media. The course focuses on collecting and analyzing data from a Windows operating system to provide information that can be used for both civil and criminal litigation. User based activity and software/hardware artifacts are analyzed along with acquisition of digital media in a Windows based environment.

Student Learning Outcomes:

Describe Windows supported file systems (i.e.: Fat, NTFS, exFat)
Discuss Windows processes and what they mean to a forensic examination.
ecure and image Windows based systems (PC’s, Physical and Virtual servers).
Describe Windows forensics artifacts and what they mean to a forensic examination.
Proficiently research new and updated applications as pertaining to a forensic examination.
Evaluate hardware and software required to build a digital forensics lab used for Windows.
Perform a basic forensic examination on digital media of a Windows system.
Communicate computer concepts, methods, and evidence clearly in written and spoken documents.
Exhibit ethical/professional behavior in attendance, class conduct, assignment completion, teamwork, and constructive peer feedback.