In this course, each voice in the classroom has something of value to contribute. Please take care to respect the different experiences, beliefs and values expressed by students and staff involved in this course. My colleagues and I support UMass’s commitment to diversity, and welcome individuals regardless of age, background, citizenship, disability, sex, education, ethnicity, family status, gender, gender identity, geographical origin, language, military experience, political views, race, religion, sexual orientation, socioeconomic status, and work experience.

View this syllabus as a guide to the course. It provides important information regarding the course, its assignments, policies, grading, and available university resources. You should refer to it regularly. However, this document should be considered a working document. It is possible throughout the semester that a topic may take more time than expected, topics or assignments may change, and so on. If that is the case, the syllabus and/or schedule will be updated and a revised version will be posted (here) on the course web site.

Course overview

Description: The goal of forensics is to gather artifacts for refinement into evidence that supports or refutes a hypothesis about an alleged crime or policy violation. Done correctly, forensics represents the application of science to law. The techniques can also be abused to thwart privacy. This course is a broad introduction to forensic investigation of digital information and devices. We will cover the acquisition, analysis, and courtroom presentation of information from file systems, operating systems, networks, cell phones, and the like. Students do not need experience with these systems. We will review the use of some professional tools that automate data harvesting, however, the primary goal of the class is to understand why and from where artifacts are recoverable in these systems. Several assignments involve coding forensic tools from scratch. For a small portion of the class, we will cover some relevant issues from the law, privacy, and current events. Thus, the class serves the well-rounded student who is eager to participate in class discussion on a variety of technical and social issues.

Prerequisites: For undergraduates: COMPSCI 220 or COMPSCI 230. CS majors only (others will need to request an override). For CS graduate students: no formal prerequisites, but note that 500-level courses do not fulfill Ph.D. requirements; M.S. and M.S./Ph.D. students may use this course in accordance with their degree requirements.

What, when, where, who

COMPSCI 365/590F: Digital Forensics
TuTh 10:00am–11:15am
Hasbrouck Lab Addition 124

Instructor: Marc Liberatore (please call me “Marc”)
Phone: 413-545-3061 (on campus: 5-3061)
Office: Lederle Graduate Research Center A351B
Office hours: Tuesday 11:30am – 1:30pm

There are four course assistants who hold office hours, answer question on Piazza, and grade:

Abhaydeep Singh
Office hours: Thursday 1pm – 2pm, USpace

Henry Ecker
Office hours: Friday 2:30pm – 4:00pm, USpace

Jucong He
Office hours: Wednesday 4pm – 5pm, USpace

Miles Gepner
Office hours: Tuesday 2:30pm – 3:30pm, CS 207 cube 4

Required materials

There is one required textbook for this class from which many readings will be assigned: Brian Carrier’s File System Forensic Analysis. Most other readings will be provided by the instructor or be available online through the UMass Library system (when logged in or on a campus network).

Code of conduct

  • The course staff are committed to providing a friendly, safe and welcoming environment for all, regardless of level of experience, gender identity and expression, sexual orientation, disability, personal appearance, body size, race, ethnicity, age, religion, nationality, or other similar characteristic.
  • Please be kind and courteous. There’s no need to be mean or rude.
  • Respect that people have differences of opinion and that differing approaches to problems in this course each carry a trade-off and numerous costs. There is seldom a single right answer to complicated questions.
  • Please keep unstructured critique to a minimum. Criticism should be constructive.
  • We will informally warn you, once, if you insult, demean or harass anyone. That is not welcome behavior. After that we will report your behavior to the Dean of Students office. We interpret the term “harassment” as including the definition in the Citizen Code of Conduct under “Unacceptable Behavior”; if you have any lack of clarity about what might be included in that concept, please read their definition. In particular, we don’t tolerate behavior that excludes people in socially marginalized groups.
  • Private harassment is also unacceptable. No matter who you are, if you feel you have been or are being harassed or made uncomfortable by a member of this class, please contact a member of the course staff immediately (or if you do not feel safe doing so, you should contact the Chair of the Faculty of CICS, currently Prof. James Allan,, or the Dean of Students office). Whether you’ve been at UMass for years or are a newcomer, we care about making this course a safe place for you and we’ve got your back.
  • Likewise any spamming, trolling, flaming, baiting or other attention-stealing behavior is not welcome.

(Partially drawn from the Rust Code of Conduct.)

Communication policy

Per the University Email Policy, you are expected to check your email regularly. I will use your UMass email address as your point of contact in all online tools we use (Moodle, Piazza, and Gradescope) and as my primary means to contact you individually outside of class. Group announcement will be posted to Piazza (which you can configure to send you via email, if you so desire).

If you send the course staff email, please include “COMPSCI 365” (or “COMPSCI 590F”) in the subject line to make sure we answer them in a timely fashion. For course-content related questions (especially questions that other students might benefit from seeing the answers to), please use Piazza. For other questions, email is best, but please check the syllabus and course web site before emailing the course staff.

Course staff typically respond to emails and Piazza questions within about one business day, but I (Marc) do not typically respond to communications after about 5pm or on weekends. Course staff tend to get a high volume of email when a deadline is approaching. If you contact us at least two full business days before an exam or deadline, you are guaranteed a reply before the exam or deadline. Otherwise we’ll do our best, but no guarantees.


Piazza is a online discussion management system. It will be used as the main hub for questions and answers in this course. Piazza is a great tool but it can be abused. Please follow these guidelines in your use of Piazza to avoid abusing it:

  • You should use Piazza to ask questions and get advice on assignments. But you should not use Piazza to step through each problem you encounter in an assignment.
  • You may not post assignment solutions to Piazza, either in questions or answers to others’ questions.
  • If you must post code you are working on, you should do so only through private posts to the course instructors.
  • You should not post code without a thoughtful and articulate question. Do not post code and ask only, “what is wrong with my code?” See, for example, or for constructive advice on asking questions.
  • You are encouraged to help other students by answering questions.

The course staff will monitor Piazza and answer your questions in a timely manner (generally within a business day or two). But do not expect us to provide real-time answers on Piazza, especially in the last few hours before an assignment is due!

If a question has already been answered in a previous post we may not respond to you. If a question does not follow the guidelines above we may not answer it. If we find that a private question is relevant to a larger audience, we may make mark it public to help others in the course.

Time management and what to expect

As a general guideline, the university suggests that students spend an additional two to three hours outside of class time per credit hour. This is a three-credit course, therefore you should plan to spend six to nine hours a week on this class outside of lecture.

In a typical week, you will attend discussion attend two lectures, complete a homework assignment which may involve significant reading, writing, and/or programming, and complete the assigned reading.


Please see the course web site for a class-by-class schedule; the topics will be approximately as follows, though there may be some adjustments as the semester goes on:

Weeks 1 & 2: Introduction to Forensics
Weeks 2, 3, 4: Data Representation, Carving Data, EXIF (midterm 1 around here: scheduled for Thu 22 Feb)
Week 5: Criminal Law and Forensics
Week 6: Network Investigations I
Week 7: Volume Acquisition, Parsing MBRs and GPTs
Week 8: Parsing FAT
Week 9 & 10: Parsing NTFS (midterm 2 around here: scheduled for Tue 03 Apr)
Week 11: Network Investigations II
Week 12: Malware, Windows Artifacts
Week 13: Various (in the past: cell phone forensics; how spinning platter magnetic hard drives work; how flash storage works; how to be an expert witness)

Final Exam: Wednesday, May 09 at 10:30 in Hasbrouck Lab Addition 124 (our usual classroom)

Grading criteria

The relative value of the various course components is approximately as follows:

65% Assignments
20% Midterms
15% Final exam

The numerical cutoff for final course letter grade assignment will be made after all grading is completed. As a rough guide, expect to require at least a 93 to get an A, a 90 to get an A-, an 87 to get a B+, an 83 to get a B, an 80 to get a B-, and so on.

There are no opportunities for extra credit in this course.

There is a 1/3 penalty per day (or fraction thereof) that an assignment is late. One day late means a score is scaled to 2/3 of its original value; two days late, to 1/3, and work later than two days late is not accepted. If you need an individual extension due to calamity (illness, trauma, death in the family, etc.), I will require documentation of the calamity.

I will retain all graded materials for this course until the end of next semester (Fall 2018). If you wish to review them, please come to see me during office hours (or make an appointment).

You are responsible for monitoring your grades. Grades will be available through Moodle (though note that some will be available in Gradescope first) and you should check them regularly and review any provided feedback. If you encounter any issues with your grades, you will have one week past the first posting of a particular assignment’s grade to Moodle to contact the course staff so that we can investigate. Please contact us via a private message on Piazza. We will not generally accept questions about an individual assignment’s grade beyond this one week, so you must be prompt.


The majority of the workload in this course will consist of take-home assignments. These assignments will involve writing, programming, or both. Written assignments will have a series of questions, and will require that you understand basic legal and technical concepts to answer them correctly. Some written assignments will require detailed analyses (for example, reasoning about a particular technology in the context of a law). Programming assignments will typically involve implementing a forensic tool from scratch using Python. Assignments are generally not collaborative: you must complete them on your own. Exceptions to this rule will be clearly noted.

We plan to give between 12 and 18 assignments (depending upon how written and programming assignments are broken up or combined into single assignments).

Each assignment will contribute a stated number of points toward the “Assignments” portion of your course grade. Each assignment may be worth a different amount of points.

Attempts to manipulate, game, or otherwise incorrectly use the autograder will be treated as academic dishonesty.

Midterms and exams

There will be two equally-weighted in-class midterms.

There will also be a cumulative final exam. You must achieve a passing grade on the final exam to pass the class.

You may not bring supplemental material to the midterms or final exam, that is, they are closed-book, and the use of notes, calculators, computers, phones, etc., is forbidden, unless otherwise explicitly stated.

Exams must be completed on your own: they are not collaborative!

590F students can expect a few additional questions on some assignments, and an additional, project-based assignment toward the last month of the semester.

590F students will have separate, more rigorous exams.


I expect you to attend lectures (and exams!).

  • If you will be absent (either from class, or from an exam) due to religious reasons, you must provide me with a written list of such dates within one week of your enrollment in the course.
  • If you will be absent for a University-related event, such as an athletic event, field trip, or performance, you must notify me as soon as possible.
  • If you are absent for health reasons, I expect you to notify me as soon as possible and provide written documentation.
  • If you are absent for other extenuating non-academic reasons, such as a military obligation, family illness, jury duty, automobile collision, etc., I expect you to notify me as soon as possible and provide written documentation.

If you must miss a quiz or exam for a documented, excusable reason, I will work with you to find an acceptable time for you to take a makeup. If you miss an exam without prior notice, I will require an explanation and clear written documentation in order to judge whether the absence is excusable.


Incompletes will be granted only in exceptional cases, and only if you have completed at least half the course with a passing grade. Prior to that, withdrawal is the recommended course of action.

Technology in the classroom

At the start of the semester, I will permit laptops and the like in the classroom. If it becomes clear that they are being used for purposes not directly related to the class, I will ban them. It is unfair to distract other students with Facebook feeds, animated ads, and the like.

Regardless, I recommend taking notes by hand. Research suggests that students who take written notes in class significantly outperform students who use electronic devices to take notes.

Offensive topics and materials

This class will occasionally involve discussion of real-life court cases and criminal scenarios. You may find some topics of discussion distasteful, offensive, disturbing, and shocking, which is atypical for Computer Science. For example, we may discuss true and hypothetical scenarios and cases of child sexual exploitation, adult pornography, homicide, and other violent crimes. You are welcome to sit out for any discussion if you feel uncomfortable, no questions asked, no need to ask ahead of time. I will try to keep all discussions at a high level and to give clear warning when we’re about to discuss potentially offensive material (and you should do the same) but it is inevitable that there will be some frank discussion in lecture, and some court decisions referenced or read will contain candid language.

Academic honesty

General academic honesty statement

Since the integrity of the academic enterprise of any institution of higher education requires honesty in scholarship and research, academic honesty is required of all students at the University of Massachusetts Amherst. Academic dishonesty is prohibited in all programs of the University. Academic dishonesty includes but is not limited to: cheating, fabrication, plagiarism, and facilitating dishonesty. Appropriate sanctions may be imposed on any student who has committed an act of academic dishonesty. Instructors should take reasonable steps to address academic misconduct. Any person who has reason to believe that a student has committed academic dishonesty should bring such information to the attention of the appropriate course instructor as soon as possible. Instances of academic dishonesty not related to a specific course should be brought to the attention of the appropriate department Head or Chair. Since students are expected to be familiar with this policy and the commonly accepted standards of academic integrity, ignorance of such standards is not normally sufficient evidence of lack of intent.

Please read the UMass Academic Honesty Policy.

Course-specific academic honesty information

Academic dishonesty is usually the result of other problems in school. Please come see me or the TA if you are unable to keep up with the work for any reason and we will do our best to work something out. I want to see you succeed, but I will not tolerate academic dishonesty.

If you engage in academic dishonesty, you will almost certainly receive an F for the course. Further, if there are formal disciplinary proceedings, I will lobby for the maximum possible penalty. Investigating academic dishonesty is an unpleasant experience for both the instructor and the student. Please help me by avoiding any questionable behavior.

What is permitted and what is not? You may discuss material with others, but when collaboration is forbidden, your writing (code and prose) must be your own. The surest ways to avoid problems are as follows: When discussing problems with others, do not show any of your solution (code or otherwise) to others. When asking others for help, do not take notes about the solution other than to jot down publicly available references. When using Piazza, don’t copy/paste large chunks of code into your question. Instead, do the same thing you should do if asking a classmate for help: ask your question by describing the problem you’re having, or use a small synthetic example that illustrates your difficulty. If you must include a large chunk of your code to ask your question on Piazza, mark it as a “private” question, and only the course staff will be able to see it.

Copying and pasting another student’s code is a violation of academic honesty, and we will endeavor to detect this by any means available to us, including automated similarity analysis of submitted assignments. Be aware that if something looks like academic dishonesty to us, we will treat it as such, unless you can provide strong evidence to the contrary. When in doubt, it is your responsibility to contact the course staff about whether a potential action would be considered academic dishonesty.

Other academic regulations

The Office of the Registrar publishes Academic Regulations yearly. You should be familiar with them. Particularly relevant are the policies on attendance, absences due to religious observance, and examinations.

Accommodation statement

The University of Massachusetts Amherst is committed to providing an equal educational opportunity for all students. If you have a documented physical, psychological, or learning disability on file with Disability Services (DS), you may be eligible for reasonable academic accommodations to help you succeed in this course. If you have a documented disability that requires an accommodation, please notify me within the first two weeks of the semester so that we may make appropriate arrangements.

A word about copyrights

Most of the material (lecture notes, lectures, assignments, and so on) in this course is original work created by the instructor (Marc Liberatore); exceptions are clearly noted (for example, I am not Brian Carrier and did not write the textbook!). While you are welcome to use the material for your own personal and educational use, you may not redistribute these materials to others outside the class. In particular, selling or otherwise redistributing your notes (or mine!), making or selling audio, video, or still recordings of course material, is not allowed without express written permission from me.

I make this stuff available on the web for you to use easily and without the hassle of sign-ups, logins, and the like, not for you to abuse for a buck. As Carol Barr (Senior Vice Provost and Dean of Undergraduate Education) and Enku Gelaye (Vice Chancellor for Student Affairs and Campus Life) noted at the start of the Fall 2017 semester, usage of notes or in-class recordings without the faculty member’s permission is a violation of the faculty member’s copyright protection.