You cannot register for this course anymore.
News
Change of tutorial room and timeWritten on 15.04.26 (last change on 15.04.26) by Daniel Kiefer Hello everyone, due to the number of participants in the tutorial we decided to change to a larger room at a different time. The time and… Read more Hello everyone, due to the number of participants in the tutorial we decided to change to a larger room at a different time. The time and location of the lecture remains unchanged. The next lecture is tomorrow, April 16, at 10 a.m. in E1 3, HS 003. I hope to see you all next Tuesday. |
Start of tutorialWritten on 14.04.26 (last change on 14.04.26) by Daniel Kiefer Hello everyone, just to clarify, as I was asked multiple times, the tutorial starts today. We will begin at 14:15 in room 206 in building E1.1. I also want to remind you that you can transfer your exam eligibility you obtained from last year if you write me an email by this friday. Hello everyone, just to clarify, as I was asked multiple times, the tutorial starts today. We will begin at 14:15 in room 206 in building E1.1. I also want to remind you that you can transfer your exam eligibility you obtained from last year if you write me an email by this friday. See you in the tutorial. |
IT Forensics
Have you ever wondered how criminals are caught in the digital era?
What traces do all of us leave on IT systems while interacting with them?
What is the truth behind those CSI movies we all know?
This advanced lecture deals with finding and evaluating legal evidence in IT systems, both for criminal prosecution and civil action.
Focus areas include, among others:
- Processes of IT forensics (with a focus on incident response)
- Analysis of storage media and file systems
- Retrieval and analysis of RAM contents (e.g., cold boot attacks)
- Attacks on passwords
- (Basics of) evidence in civial actions and criminal proceedings
- Role of technical experts in court
You will not only learn about these topics in theory, but also get some hands-on experience.
Date and time of the lecture: Thursdays, 10 a.m. – 12 p.m., HS 003 in E1 3
The lectures and tutorials will be taught in English and will not be recorded.
The Campus Library for Computer Science and Mathematics has set up a course reserve for the lecture: https://www.infomath-bib.de/tmp/vorlesungen/info-advanced_it-forensics.html . The books can be borrowed or read on-site. Some books may also be available in digital format.
Prerequisites
We recommend that you have previously taken courses on operating systems and the foundations of cybersecurity.
Tutorials
Date and time: Tuesdays, 12-2 p.m. 2–4 p.m., HS III in E2 5 SR206 in E1 1 (except May 5, when it will be held in room 0.08 in E1 7). Starting in the second week.
The tutorials will not be recorded.
Some tutorials will contain practical exercises, for those you need to bring a laptop. Installation requirements will be announced.
Attending the tutorials is optional, but highly recommended. You will not only get the chance to ask questions and solve exam-like exercises, but also get practical experience.
Exercises
We have 7 exercise sheets that you submit here on CMS.
- Most of the questions require structured input (multiple choice, pasting hash values, CTF-style flags, ...).
- Sheets need to be solved individually.
- We enforce a strict no-plagiarism policy. You can discuss your approach and possible solutions in groups, but the final wording must come from you.
- All sheets will be graded in a semi-automated way.
You need to submit at least 6 of the 7 sheets, score at least 60 out of 100 points in total and at least 40% on each of the 6 submitted sheets to be admitted to the final exam and re-exam.
Questions regarding the transfer of exercise credits from previous semesters should be addressed at the beginning of the lecture period.
Examination
The course concludes with a written final exam on campus that determines your final grade.
Main Exam:
July 31, 10:00 s.t. – 11:15 (E1 3, HS 001 and 003)
Re-Exam:
October 7, 10:00 s.t. – 11:15 (E1 3, HS 001 and 003)