Introduction to Digital Forensics

Digital Forensics is a branch of forensic sciences that involves retrieving, analyzing, and storing of electronic

data found in many devices such as personal and business computers, mobile devices, digital cameras, storage devices, and network devices that may contain evidence of a crime. However, in recent years data also includes the cloud, motor vehicles, and drones. The digital evidence collected is used by law enforcement agencies to prosecute all crimes, not just electronic crimes (e-crimes) such as child pornography or credit card fraud. Therefore, today’s law enforcement agencies are incorporating computer forensics in their infrastructures.

The focus of this course is to give students a basic understanding of the investigative procedures involving the examination of digital evidence - following proper search authority, chain of custody, validation, the use of validated tools, and reporting.

Course Highlights:

• The principles and components of Digital Forensics
• Investigative process
• Validation
• Digital Forensic Tools (open source)
• The chain of custody

Course Learning outcomes:

• Different branches of Digital Forensics: computer forensics, mobile device forensics, network forensics
• Investigative process: Identification, preservation, collection, examination, analysis, presentation
• Open-source forensic tools: FTK imager, Autopsy, Sumuri Paladin
• Acquisition types: Physical and logical

Course typically offered: Online every Spring and Fall

Prerequisite: Student should have basic to intermediate knowledge of computers and networking principals. The students should also have basic computer skills and be able to download (open source) programs.

Next Step: After completing this course, consider taking CSE-41359 Information Security Management to continue learning.

Contact: For more information about this course, please email infotech@ucsd.edu.