Instructors: Profs. J Genetti and K Nance
Office Hours: 208B Chapman MWF 2:30-3:30, T 2:00-3:30, or by appointment
Phone/Email: 474-5737 / ffjdg @ uaf . edu
Class web page: http://www.cs.uaf.edu/~cs393
Prerequisite: CS201 or ES201 or permission of instructor
Department policies: www.cs.uaf.edu/dms/Policies.html
Textbooks:
Digital Evidence and Computer Crime by Eoghan Casey
Incident Response: Investigating Computer Crime by Chris Prosise & Kevin Mandia

Overview:
Computer Forensics is a newly emerging area that uses procedure-centric approaches to cyber-attack prevention, detection, and incident response. Since no system can be 100% secure, we will study procedures to detect and gather court-admissible evidence using various forensic techniques.

Topics:

• Introduction to forensic science and digital evidence
• Computer security policies and guidelines
• Overview of forensic analysis software
• Legal/privacy aspects of computer forensics
• Documenting an investigation
• Non-networked computers
• Forensic duplication and analysis
• Networked computers
• Internet evidence and server logs
• Network surveillance
• Investigating unauthorized access to MS Windows machines
• Investigating unauthorized network access to UNIX machines

Grading Policy:
Final grades will be assigned based on the following percentage intervals:
A - [89.5%, 100%]
B - [79.5%, 89.5%)
C - [69.5%, 79.5%)
D - [59.5%, 69.5%)
F - [0.0%, 59.5%)

The assignments/exams will be weighted as follows:
Homework: 40%
Project/Presentation: 20%
Midterm: 20%
Final Exam: 20%

Homework:
Homework will be regularly assigned and is due by 5PM on the due date. Late assignments will not be accepted. Students may discuss possible approaches to problems, specific syntax questions and aspects of debugging. However, all programs and written assignments are to be done strictly on an individual basis, unless otherwise specified.

Project/Presentation:
Groups of students will solve a unique forensic investigation and present the results to the class. Presentations will be graded on correctness, depth of analysis and clarity of presentation.

Exams:
Exams may consist of any mix of multiple choice, short answer, program fragments and short essay questions. Your goal should be to demonstrate knowledge and understanding of course concepts.