IT Forensics Sorge

News

03.11.2021

Final re-exam inspection details

Hi all,

I sent the time slots for the re-exam inspection tomorrow to all registered participants by e-mail. If you have not received the e-mail, but registered for the re-exam inspection, please let me know.

The time slots are 1:00 - 1:30 pm CET (13:00 -... Weiterlesen

Hi all,

I sent the time slots for the re-exam inspection tomorrow to all registered participants by e-mail. If you have not received the e-mail, but registered for the re-exam inspection, please let me know.

The time slots are 1:00 - 1:30 pm CET (13:00 - 13:30) and 1:45 - 2:15 pm CET (13:45 - 14:15). The room is HS003 in E1 3. Please come only at the time of your time slot and bring your student id card with you. Do not forget to wear a mask (surgical mask or FFP2/KN95/N95 mask).

We need to inform you about the following:

If your answer is "yes" to one or more of the following questions, then you are not allowed to attend the exam inspection.

- Did you have definite contact with a Covid-19 patient, who was tested positive, in the last 14 days?

- Do you have any of the following symptoms?
* Cough / Husten
* Sore throat / Halsschmerzen
* Nasal congestion / runny nose / Schnupfen
* Diarrhoea / Durchfall
* Fever / Fieber
* Aches and pains / Gliederschmerzen
* Loss of smell (e.g. no longer able to smell burnt food) / Geruchsverlust
* Loss of taste (e.g. unable to distinguish when food is burnt) / Geschmacksverlust

If a student is not sure about the answer to one of these questions, then he/she has to consult a doctor to decide whether or not his/her health status is critical. If the decision is that he/she can participate, then he/she has to bring a medical certificate along to the re-exam inspection.

Best,

Leo

15.10.2021

Registration for re-exam inspection

Hi all,

Please register here if you want to participate in the re-exam inspection: https://kingsx.cs.uni-saarland.de/index.php/apps/forms/2ARZsGNbyJFNPcjr

Please register until October 20, 11:55 pm. We will announce the date and room as soon as we know the... Weiterlesen

Hi all,

Please register here if you want to participate in the re-exam inspection: https://kingsx.cs.uni-saarland.de/index.php/apps/forms/2ARZsGNbyJFNPcjr

Please register until October 20, 11:55 pm. We will announce the date and room as soon as we know the number of participants who want to attend the exam inspection.

Best,

Leo

12.10.2021

Exam results

We have finished grading the re-exam!
The results should be visible in the CMS; please let us know if this is not the case. For technical reasons, the result "5.0" (0 points) will be shown if you did not register for the exam, but are registered in the CMS. Of... Weiterlesen

We have finished grading the re-exam!
The results should be visible in the CMS; please let us know if this is not the case. For technical reasons, the result "5.0" (0 points) will be shown if you did not register for the exam, but are registered in the CMS. Of course, we will only enter your grade into the LSF if you were actually registered. We have done our best to ensure that we entered the points correctly, though mistakes cannot be completely excluded. Those who are not registered in the CMS can ask us for the grade by e-mail (please inform those people if you happen to know them).

Overall, you could reach 90 points. The best grade, 1.0, was awarded from 79 points. The passing limit was 42 points. Both is identical to the first exam. The grade average for those present in the exam was 3.16 (also identical to the first exam), the median grade 3.3.

11.10.2021

Final re-exam details

Hi all,

Please note the following due to the current Corona regulations:

If you have a high individual risk (e.g., due to your own illness, or due to relatives who are at risk), please let us know and we will do our best to assign a seat away from... Weiterlesen

Hi all,

Please note the following due to the current Corona regulations:

If you have a high individual risk (e.g., due to your own illness, or due to relatives who are at risk), please let us know and we will do our best to assign a seat away from others.

If your answer is "yes" to one or more of the following questions, then you are not allowed to attend the IT Forensics re-exam. Please contact us in this case. If you provide a doctor’s certificate to the examination office later on, the examination attempt will be canceled and will not count.

  1. Did you have definite contact with a Covid-19 patient, who was tested positive, in the last 14 days?
     
  2. Do you have any of the following symptoms?
  • Cough / Husten
  • Sore throat / Halsschmerzen
  • Nasal congestion / runny nose / Schnupfen
  • Diarrhoea / Durchfall
  • Fever / Fieber
  • Aches and pains / Gliederschmerzen
  • Loss of smell (e.g. no longer able to smell burnt food) / Geruchsverlust
  • Loss of taste (e.g. unable to distinguish when food is burnt) / Geschmacksverlust

If you are not sure about the answer to one of these questions, then please consult a doctor to decide whether or not your health status is critical. If the decision is that you can participate, then please bring a medical certificate along to the re-exam.

All staff assigned to the exam supervision is fully vaccinated, and will wear masks.

Good luck for the exam!

08.10.2021

Paper of the second assignment

Hi all,

Because some of you asked, I would like to clarify that the paper "One key to rule them all: Recovering the master key from RAM to break Android's file-based encryption" discussed in the second assignment is still important for the re-exam. Please have a... Weiterlesen

Hi all,

Because some of you asked, I would like to clarify that the paper "One key to rule them all: Recovering the master key from RAM to break Android's file-based encryption" discussed in the second assignment is still important for the re-exam. Please have a look at the paper to be prepared for a possible task. Also, it won't hurt to know how to do calculations that were discussed in the lectures and the tutorials (as all content discussed in the lectures and the tutorials can be part of the re-exam).

Best,

Leo

08.10.2021

Re-exam details

Hi all,

With this e-mail you will receive all details for the upcoming re-exam. Please read all the details carefully and let us know if you have any question.

1. Date and time of the re-exam:

The re-exam will take place on October 12th, 2021, at 09:30... Weiterlesen

Hi all,

With this e-mail you will receive all details for the upcoming re-exam. Please read all the details carefully and let us know if you have any question.

1. Date and time of the re-exam:

The re-exam will take place on October 12th, 2021, at 09:30 am. You will have 90 minutes to work on the re-exam.

Please be there no later than 09:10 am so we can start on time.
 

2. Location of the re-exam:

All students will write the re-exam in HS 002 in the building E1 3.
 

3. Note the following due to the current Corona regulations:

  • Please note that it is necessary for you to bring your medical mouth-nose protection mask (surgical mask or FFP2 / KN95 / N95 mask) with you.
     
  • While entering/leaving the room (this includes also waiting situations), moving in the room, and while talking to supervisors, medical mouth-nose protection (surgical masks) or FFP2 / KN 95 / N95 masks are mandatory. It is recommended that everyone wears protective masks during the entire re-exam, also while sitting at the seat, but it is not mandatory.
     
  • A negative PoC antigen test not older than 24 hours or vaccination or recovery is recommended, but not mandatory.
     

4. Further details:

It is not allowed to use lecture notes, a dictionary or a calculator during the re-exam. The re-exam is designed so that you can pass it without these materials.

Please note that you are allowed to participate in the re-exam only if you have registered in the LSF (or the portal corresponding to your course of study if you cannot use the LSF). If you are unsure about this, please send us an e-mail.

One day before the re-exam, you will receive another e-mail with further instructions on the Corona regulations.

If you have questions, please let us know.

20.09.2021

Re-exam registration

Hi all,

Please remember to register in time for the re-exam of IT Forensics if you want to participate. You need to register at least one week before the re-exam using the LSF portal.

Best,

Leo

19.09.2021

Q&A session tomorrow

Hi all,

You voted for a date of the Q&A session and tomorrow suites best for most of you. Thus, we will meet tomorrow at 15:00 CEST via zoom:

https://us02web.zoom.us/j/84934623177?pwd=UWVIZHJGV2x2dzdnQy94dVRxM2Mxdz09

Meeting ID: 849 3462 3177
Passcode:... Weiterlesen

Hi all,

You voted for a date of the Q&A session and tomorrow suites best for most of you. Thus, we will meet tomorrow at 15:00 CEST via zoom:

https://us02web.zoom.us/j/84934623177?pwd=UWVIZHJGV2x2dzdnQy94dVRxM2Mxdz09

Meeting ID: 849 3462 3177
Passcode: 158840

Best,

Leo

16.09.2021

Final exam inspection details

Hi all,

I just sent the time slots for the exam inspection to all people by e-mail who registered for it. If you have not received the e-mail, but registered for the exam inspection, please send me an e-mail.

We have two slots: 11:15 am - 12:00 pm and 12:15... Weiterlesen

Hi all,

I just sent the time slots for the exam inspection to all people by e-mail who registered for it. If you have not received the e-mail, but registered for the exam inspection, please send me an e-mail.

We have two slots: 11:15 am - 12:00 pm and 12:15 pm - 1 pm

Please come to the room E2 2 (GHH) only at the time of your slot and bring your student id card with you. Do not forget to wear a mask (surgical mask or FFP2/KN95/N95 mask).

Here is one more hint:

If your answer is "yes" to one or more of the following questions, then you are not allowed to attend the exam inspection.

- Did you have definite contact with a Covid-19 patient, who was tested positive, in the last 14 days?

- Do you have any of the following symptoms?
* Cough / Husten
* Sore throat / Halsschmerzen
* Nasal congestion / runny nose / Schnupfen
* Diarrhoea / Durchfall
* Fever / Fieber
* Aches and pains / Gliederschmerzen
* Loss of smell (e.g. no longer able to smell burnt food) / Geruchsverlust
* Loss of taste (e.g. unable to distinguish when food is burnt) / Geschmacksverlust

If a student is not sure about the answer to one of these questions, then he/she has to consult a doctor to decide whether or not his/her health status is critical. If the decision is that he/she can participate, then he/she has to bring a medical certificate along to the exam inspection.

Best,
Leo

15.09.2021

Further details for exam inspection

Hi all,

the exam inspection will take place in the room E2 2 (GHH) where you also wrote the exam. I will wait until tomorrow to send you your personal time slot, so more students have the possibility to register. Please check your email tomorrow in the evening... Weiterlesen

Hi all,

the exam inspection will take place in the room E2 2 (GHH) where you also wrote the exam. I will wait until tomorrow to send you your personal time slot, so more students have the possibility to register. Please check your email tomorrow in the evening or friday morning. The time slots will be between 11 am - 1 pm CEST (11-13 Uhr), but please come only to the time slot reserved for you.

Also, please note the following:

  • Please note that it is necessary for you to bring your own medical mouth-nose-protection mask (surgical mask or FFP2/KN95/N95 mask) with you.
     
  • While entering/leaving the room (this includes also waiting situations), moving in the room, and while talking to supervisors, medical mouth-nose protection (surgical masks) or FFP 2 / KN 95 / N95 masks are mandatory. It is recommended that everyone wears protective masks during the exam inspection, also while sitting at the seat.
     
  • A safety distance of at least 1.5m should be kept at all times, in particular when discussing individual exams.

If you have questions, please send me an e-mail at any time.

Best,
Leo

14.09.2021

Registration for exam inspection

Hi all,

Please register here if you want to participate in the exam inspection: https://kingsx.cs.uni-saarland.de/index.php/apps/forms/fi2fRX8oKgYjkmZF

Best,
Leo

13.09.2021

Q&A session for second exam

Hi all,

I hope you had some days to relax and enjoy the summer during the last few weeks :)

I will offer an online Q&A session for the second IT Forensics exam next week. Please vote for one of the possible dates by September 18, so we can choose the one... Weiterlesen

Hi all,

I hope you had some days to relax and enjoy the summer during the last few weeks :)

I will offer an online Q&A session for the second IT Forensics exam next week. Please vote for one of the possible dates by September 18, so we can choose the one which suites best for you: https://kingsx.cs.uni-saarland.de/index.php/apps/forms/a6wHbywBD4GcfjwZ

Also, please write down your questions in the form or send them to me by email until September 18. Thank you.

Best,
Leo

10.09.2021

Exam inspection

Hi all,

We would like to inform you that the exam inspection for the IT Forensics exam will take place next Friday (17th of September). We will provide you with further details next week, including time, location and Covid protection measures.

Best,

Leo

13.08.2021

Exam results

We have finished grading the final exam!
The results should be visible in the CMS; please let us know if this is not the case. For technical reasons, the result "5.0" (0 points) will be shown if you did not register for the exam, but are registered in the CMS. Of... Weiterlesen

We have finished grading the final exam!
The results should be visible in the CMS; please let us know if this is not the case. For technical reasons, the result "5.0" (0 points) will be shown if you did not register for the exam, but are registered in the CMS. Of course, we will only enter your grade into the LSF if you were actually registered. We have done our best to ensure that we entered the points correctly, though mistakes cannot be completely excluded.

Overall, you could reach 90 points. The best grade, 1.0, was awarded from 79 points. The passing limit was 42 points. The grade average for those present in the exam was 3.16, the median grade 3.0.

08.08.2021

Final exam details

Hi all,

Please note the following due to the current Corona regulations:

If your answer is "yes" to one or more of the following questions, then you are not allowed to attend the IT Forensics main exam. Please contact us in this case. If you provide a... Weiterlesen

Hi all,

Please note the following due to the current Corona regulations:

If your answer is "yes" to one or more of the following questions, then you are not allowed to attend the IT Forensics main exam. Please contact us in this case. If you provide a doctor’s certificate to the examination office later on, the examination attempt will be canceled and will not count.

  1. Did you have definite contact with a Covid-19 patient, who was tested positive, in the last 14 days?
     
  2. Do you have any of the following symptoms?
    • Cough / Husten
    • Sore throat / Halsschmerzen
    • Nasal congestion / runny nose / Schnupfen
    • Diarrhoea /Durchfall
    • Fever /Fieber
    • Aches and pains / Gliederschmerzen
    • Loss of smell (e.g. no longer able to smell burnt food) / Geruchsverlust
    • Loss of taste (e.g. unable to distinguish when food is burnt) / Geschmacksverlus

If you are not sure about the answer to one of these questions, then please consult a doctor to decide whether or not your health status is critical. If the decision is that you can participate, then please bring a medical certificate along to the exam.

Quick summary about the details for the exam:

  • Students whose last name begins with A-G will write the exam in the GHH Foyer.

  • All other students will write the exam in the GHH Lecture Hall.

  • Start: 9:30 am (please be there no later than 09:15 am so we can start on time)

 

Good luck for the exam!

05.08.2021

Clarification regarding Covid protection measures

Dear all,

we have received questions concerning the Covid protection measures.

Therefore, I would like to clarify:

  • We strongly recommend wearing masks (surgical masks, FFP 2 or KN95 masks) during the entire time of the exam. All staff assigned to the... Weiterlesen

Dear all,

we have received questions concerning the Covid protection measures.

Therefore, I would like to clarify:

  • We strongly recommend wearing masks (surgical masks, FFP 2 or KN95 masks) during the entire time of the exam. All staff assigned to the exam supervision is fully vaccinated, and will wear masks as well.
  • In addition, we ask each of you to perform a self-test, or get a free rapid antigen test prior to the exam. Note that we currently see an exponential rise in infection numbers, and that the delta variant is more infectious than earlier virus variants. Please act responsibly!
  • If you want to get vaccinated, this is a reminder that vaccinations are now possible without appointment, e.g. in the vaccination center in Saarbrücken.
  • If you have a high individual risk (e.g., due to your own illness, or due to relatives who are at risk), please let us know and we will do our best to assign a seat away from others.

Best regards,

Christoph Sorge

04.08.2021

Exam details

Hi all,

With this e-mail you will receive all details for the upcoming exam. Please read all the details carefully and let us know if you have any question.

1. Date and time of the exam:

The exam will take place on August 9, 2021, at 09:30 am. You will... Weiterlesen

Hi all,

With this e-mail you will receive all details for the upcoming exam. Please read all the details carefully and let us know if you have any question.

1. Date and time of the exam:

The exam will take place on August 9, 2021, at 09:30 am. You will have 90 minutes to work on the exam.

Please be there no later than 09:15 am so we can start on time.


2. Location of the exam:

We have booked the following rooms in the building E2 2:

Students whose last name begins with A-G will write the exam in the GHH Foyer.

All other students will write the exam in the GHH Lecture Hall.


Please note: Students who are to be seated in the GHH Foyer should use the entrances on the ground floor near E2 1, while those who are to be seated inside the GHH should come through the back doors near E2 4. See map for details.


3. Note the following due to the current Corona regulations:

  1. Please note that it is necessary for you to bring your medical mouth-nose protection mask (surgical mask or FFP2 / KN95 / N95 mask) with you.
     
  2. While entering/leaving the room (this includes also waiting situations), moving in the room, and while talking to supervisors, medical mouth-nose protection (surgical masks) or FFP2 / KN 95 / N95 masks are mandatory. It is recommended that everyone wears protective masks during the entire exam, also while sitting at the seat, but it is not mandatory.
     
  3. A negative PoC antigen test not older than 24 hours or vaccination or recovery is recommended, but not mandatory.


4. Further details

It is not allowed to use lecture notes or a dictionary during the exam. The exam is designed so that you can pass it without these materials.

Please note that you are allowed to participate in the exam only if you have registered in the LSF. If you are unsure about this, please send us an e-mail.

One day before the exam, you will receive another e-mail with further instructions on the Corona regulations.

If you have questions, please let us know.

31.07.2021

Reminder: Exam registration possible until Monday

Hi all,

This is a short reminder for the exam registration: Please note that the registration phase ends on Monday. If you want to participate in the exam and have not registered yet, please register for the exam using the LSF portal.

Best,

Leo

28.07.2021

Lecture recording uploaded (13.7.21)

Hi all,

the lecture recording of 13th of July was uploaded. It was the only one missing, so the lecture recordings are now complete.

If you have questions regarding the exam, simply write me an e-mail.

Best,

Leo

20.07.2021

Paper of the second assignment

Hi all,

Because maybe not everyone was present during the tutorials and the discussion of the second assignment, I would like to point out that on the second assignment there was an exercise on the paper "One key to rule them all: Recovering the master key from... Weiterlesen

Hi all,

Because maybe not everyone was present during the tutorials and the discussion of the second assignment, I would like to point out that on the second assignment there was an exercise on the paper "One key to rule them all: Recovering the master key from RAM to break Android's file-based encryption" for which maybe there will be an exercise in the exam. Please have a look at the second assignment to be prepared. So far I have only pointed it out in the tutorials (also on the slides) and when discussing the assignment, but maybe not everyone was present there.

Best,

Leo

03.07.2021

Course evaluation

Hi all,

With this email we ask you to participate in the course evaluation. Some of you already participated during the tutorial. For all those who have not yet participated, please do so by visiting the following links:

Lecture: ... Weiterlesen

Hi all,

With this email we ask you to participate in the course evaluation. Some of you already participated during the tutorial. For all those who have not yet participated, please do so by visiting the following links:

Lecture: https://qualis.uni-saarland.de/eva/?l=130378&p=vdepef

Tutorial: https://qualis.uni-saarland.de/eva/?l=1303781&p=y3rypi

Thank you very much.

Best,

Leo

03.07.2021

Assignment 2 available

Hi all,

We just uploaded the second assignment. It contains theoretical and practical exercises. You can download it here:

  https://cms.cispa.saarland/itf21/materials/

We will discuss the assignment on July 16th at 2 pm (c.t.) via zoom:

 ... Weiterlesen

Hi all,

We just uploaded the second assignment. It contains theoretical and practical exercises. You can download it here:

  https://cms.cispa.saarland/itf21/materials/

We will discuss the assignment on July 16th at 2 pm (c.t.) via zoom:

  https://us02web.zoom.us/j/82055472990?pwd=MDZKZmo0TVIram1TcU9yZmYrWlpJQT09
  Meeting ID: 820 5547 2990
  Passcode: 177241

I would be happy if some of you would upload their solutions and present them. Please upload them here until July 15th:

  https://kingsx.cs.uni-saarland.de/index.php/s/s3tfQjnPFMMdSJC

Please note: It is not mandatory to complete the exercises in order to be allowed to participate in the exam. However, we highly recommend working on them in order to be well prepared for the exam.

If you have questions, please send me an email.

Best,

Leo

02.07.2021

Exam registration

Hi all,

Some of you asked about the details of the exam registration: Please register for the exam using the LSF portal. You do not need to register via CMS.

Best,

Leo

08.06.2021

Mid-term exam available

Hi all,

We just uploaded the mid-term exam. You can download it here:

  https://cms.cispa.saarland/itf21/materials/

We will discuss the mid-term exam in two weeks in the tutorials.

If you have questions, please send me an email.

Best,

Leo

01.06.2021

Exam details

Hi all,

Some people asked me about the exact exam dates. I already provided the dates to you in the second tutorial, but I will summarize all details about the exams here again:

When will the exams take place?

The final exam will take place on 9th of... Weiterlesen

Hi all,

Some people asked me about the exact exam dates. I already provided the dates to you in the second tutorial, but I will summarize all details about the exams here again:

When will the exams take place?

The final exam will take place on 9th of August 2021. The re-exam will take place on 12th of October 2021.

Can I improve my grade after passing the first exam (by taking the re-exam)?

Yes, this is possible if it is allowed according to your exam regulations as the lecture is an advanced lecture ("Vertiefungsvorlesung"). Please check your exam regulations if you think about this.

What else do I have to consider?

We were informed that you need to register in accordance with regulations at least one week before the (re-)exam.

If you have questions, don't hesitate to contact me.

Best,
Leo

25.05.2021

Tutorial tomorrow (wednesday) at 2pm

Hi all,

as already announced, the tutorial tomorrow on wednesday will take place at 2pm, because we have a chair meeting at regular time. Please use the following link to connect:

  https://us02web.zoom.us/j/85309815893?pwd=a0xNQkNNNC85ZkVsR3Jla2VFNzFoUT09
... Weiterlesen

Hi all,

as already announced, the tutorial tomorrow on wednesday will take place at 2pm, because we have a chair meeting at regular time. Please use the following link to connect:

  https://us02web.zoom.us/j/85309815893?pwd=a0xNQkNNNC85ZkVsR3Jla2VFNzFoUT09
  Meeting ID: 853 0981 5893
  Passcode: 054296

Best,

Leo

25.05.2021

Assignment 1 available

Hi all,

We just uploaded the first assignment. It contains theoretical and practical exercises. You can download it here:

  https://cms.cispa.saarland/itf21/materials/

We will discuss the assignment on June 16th at 2 pm (c.t.) via zoom:

 ... Weiterlesen

Hi all,

We just uploaded the first assignment. It contains theoretical and practical exercises. You can download it here:

  https://cms.cispa.saarland/itf21/materials/

We will discuss the assignment on June 16th at 2 pm (c.t.) via zoom:

  https://us02web.zoom.us/j/86141685642?pwd=dWhvTVJMOTFCdGVDQ3c0ZUxYOWhRdz09
  Meeting ID: 861 4168 5642
  Passcode: 183369

I would be happy if some of you would upload their solutions and present them. Please upload them here until June 15th:

  https://kingsx.cs.uni-saarland.de/index.php/s/SYrKyYpTER9wf9X

Please note: It is not mandatory to complete the exercises in order to be allowed to participate in the exam. However, we highly recommend working on them in order to be well prepared for the exam.

If you have questions, please send me an email.

Best,

Leo

Show all
 

IT Forensics

The lecture deals with finding and evaluating legal evidence in IT systems, both for criminal prosecution and civil action.

 

Focus areas include, among others:

 

Processes of IT forensics (with a focus on incident response)

Analysis of storage media and file systems

Retrieval and analysis of RAM contents (e.g., cold boot attacks)

Attacks on passwords

(Basics of) evidence in civial actions and criminal proceedings

Role of technical experts in court

 

Lecture: Tuesdays, 10-12 h (c.t.)

Starts in the first week of the semester

https://us02web.zoom.us/j/88094668463?pwd=dzlpTFFBS25GRzh6R2YzSjNCRWdnUT09

Meeting-ID: 880 9466 8463
Password: 108405

 

Tutorial: Tuesdays, 16-18 h (c.t.), in English

Starts in the second week of the semester

https://us02web.zoom.us/j/87879267033?pwd=eUdWRUd3eGNhNFBkckhwbWx1UE9qQT09

Meeting-ID: 878 7926 7033
Password: 842952

 

Tutorial: Wednesdays, 16-18 h (c.t.), in German

  https://us02web.zoom.us/j/89963832642?pwd=S0pLcWFnVFM3MmJBemtxNVo4K09HQT09

  Meeting-ID: 899 6383 2642
  Kenncode: 446251



Datenschutz | Impressum
Bei technischen Problemen wenden Sie sich bitte an die Administratoren