IT Forensics

 

Have you ever wondered how criminals are caught in the digital era?
What traces do all of us leave on IT systems while interacting with them?
What is the truth behind those CSI movies we all know?

This advanced lecture deals with finding and evaluating legal evidence in IT systems, both for criminal prosecution and civil action.

Focus areas include, among others:

• Processes of IT forensics (with a focus on incident response)
• Analysis of storage media and file systems
• Retrieval and analysis of RAM contents (e.g., cold boot attacks)
• Attacks on passwords
• (Basics of) evidence in civial actions and criminal proceedings
• Role of technical experts in court

You will not only learn about these topics in theory, but also get some hands-on experience.

The lectures and tutorials will be taught in English and will not be recorded.

The Campus Library for Computer Science and Mathematics has set up a course reserve for the lecture: https://www.infomath-bib.de/tmp/vorlesungen/info-advanced_it-forensics.html . The books can be borrowed or read on-site. Some books may also be available in digital format.

 

Prerequisites

We recommend that you have previously taken courses on operating systems and the foundations of cybersecurity.

 

Tutorials

Date and time: tba

The tutorials will not be recorded.

Some tutorials will contain practical exercises, for those you need to bring a laptop. Installation requirements will be announced.

Attending the tutorials is optional, but highly recommended. You will not only get the chance to ask questions and solve exam-like exercises, but also get practical experience.

 

Exercises

We have 7 exercise sheets that you submit here on CMS.

• Most of the questions require structured input (multiple choice, pasting hash values, CTF-style flags, ...). 
• Sheets need to be solved individually.
• We enforce a strict no-plagiarism policy. You can discuss your approach and possible solutions in groups, but the final wording must come from you.
• All sheets will be graded in a semi-automated way.

You need to submit at least 6 of the 7 sheets, score at least 60 out of 100 points in total and at least 40% on each of the 6 submitted sheets to be admitted to the final exam and re-exam.

Questions regarding the transfer of exercise credits from previous semesters should be addressed at the beginning of the lecture period.

 

Examination

The course concludes with a written final exam on campus that determines your final grade.