Computer Forensics

Digital Forensic is a fast-growing field with a significant demand both for skilled professionals and smart researchers. Whether we consider “traditional” crime or information security breaches, stalking or cyber attacks, we note that culprits leave behind a huge amount of digital traces, frequently much more digital than physical traces. Following those traces and turning them into court evidence is the business of digital investigators and forensic scientists.
The course will help students in building strong foundations in the digital forensic scence, in learning how to turn scientific methods into real-word techniques, and how to apply such techniques to real cases.
The course will cover the following topics:
- Bringing science to digital forensics: from the Daubert Standard to the Federal Rules of Evidence. Digital Evidence in EU and Italy. The 2009 NSF Report and its effects on Digital Forensics.
- The ISO-IEC 27037 Standard (Guidelines for Identification, Collection, Acquisition and Preservation of Digital Evidence) and the Council of Europe Electronic Evidence Guidelines (COE-EEG)
- The basics of digital forensics: identifying, preserving and collecting evidence. Online (live) and offline (post-mortem) analysis. File system and log analysis.
- Advanced topics: Timeline analysis. Analysis of georeferenced data. Mobile forensics. Cloud forensics. Multimedia forensics. Email and communication system forensics.
- Presenting digital evidence to trial courts. Data visualization techniques for digital forensics data.
The course will also provide an hindsight on how forensic software tools are built and how to proficiently use them to process digital evidences.