Syllabus

Welcome

In this course, each voice in the classroom has something of value to contribute. Please take care to respect the different experiences, beliefs and values expressed by students and staff involved in this course. My colleagues and I support UMass’s commitment to diversity, and welcome individuals regardless of age, background, citizenship, disability, sex, education, ethnicity, family status, gender, gender identity, geographical origin, language, military experience, political views, race, religion, sexual orientation, socioeconomic status, and work experience.

View this syllabus as a guide to the course. It provides important information regarding the course, its assignments, policies, grading, and available university resources. You should refer to it regularly. However, this document should be considered a working document. It is possible throughout the semester that a topic may take more time than expected, topics or assignments may change, and so on. If that is the case, the syllabus and/or schedule will be updated and a revised version will be posted (here) on the course web site.

Course overview

Description: The goal of forensics is to gather artifacts for refinement into evidence that supports or refutes a hypothesis about an alleged crime or policy violation. Done correctly, forensics represents the application of science to law. The techniques can also be abused to thwart privacy. This course is a broad introduction to forensic investigation of digital information and devices. We will cover the acquisition, analysis, and courtroom presentation of information from file systems, operating systems, networks, cell phones, and the like. Students do not need experience with these systems. We will review the use of some professional tools that automate data harvesting, however, the primary goal of the class is to understand why and from where artifacts are recoverable in these systems. Several assignments involve coding forensic tools from scratch. For a small portion of the class, we will cover some relevant issues from the law, privacy, and current events. Thus, the class serves the well-rounded student who is eager to participate in class discussion on a variety of technical and social issues.

Prerequisites: Prerequisite: COMPSCI 230 with a grade of ‘C’ or better. Open to Senior, Junior or Sophomore Computer Science majors only. Other students may request an override.

What, when, where, who

Office hours:

Need to contact us? Use the Google Form listed on our Moodle site. Please do not use email; see below.

Required materials

There is one required textbook for this class from which many readings will be assigned: Brian Carrier’s File System Forensic Analysis. It is available from the UMass library for free! Most other readings will be provided by the instructor or be available online through the UMass Library system (when logged in or on a campus network) if possible.

iClickers: This course includes in-class iClicker questions that are a part of your final grade. Please purchase a iClicker device and bring it to every class. There is an app that you can use instead but you have to agree to let the app know your GPS location when using it.

Code of conduct

(Partially drawn from the Rust Code of Conduct.)

Please note the following announcement from the Dean of CICS:

During the 2022-23 academic year, we became aware of several incidents in which CICS students behaved in ways that go against our CICS values and mission. In particular, racist, sexist, and other disrespectful behavior will not be tolerated in our classrooms. This email is a reminder of CICS and university expectations for classroom civility and respect. As described in the Guidelines for Classroom Civility and Respect (linked below), students are expected to engage in behavior that promotes the shared goal of facilitating a safe and open exchange of ideas. This does not mean that all ideas are appropriate for sharing in a classroom situation. Should students engage in behavior or speech that disrupts the instructional setting or is clearly disrespectful of the instructor or fellow students, faculty are obligated to report these incidences to the university’s Dean of Students Office. Such violations of the Classroom Civility and Respect policy will have consequences that could include disenrollment from class. Please note that the CICS community takes seriously the rights of students to have the optimum opportunity to learn and the rights of every faculty member to have the best opportunities to teach. For more information on the university’s Classroom Civility and Respect policy, please see the following link. https://www.umass.edu/dean_students/campus-policies/classroom. Questions about this policy should be directed to the university’s Dean of Students Office: https://www.umass.edu/dean_students/contact-us.

Communication policy

Per the University Email Policy, you are expected to check your email regularly – at least once a day. I will use your UMass email address as your point of contact in all online tools we use (Moodle, CampusWire, and Gradescope) and as my primary means to contact you individually outside of class. Group announcement will be posted to CampusWire, which by default will send you via email whenever an instructor makes a post.

Please don’t use email to ask questions of me or the TAs; it won’t get answered in a timely fashion.

“Usual” questions about course content or simple logistics should go through Campuswire. Especially for questions that other students might benefit from seeing the answers, please use CampusWire.

For all other special requests, please use the Google Form listed on our Moodle site. We cannot handle the logistics of emails, DMs, phone calls and the like going to different course staff haphazardly; we need these special requests to be centralized. Special requests include questions about missed deadlines or exams, notifications of illness or injuries, or the like, containing personal information. These requests will be reviewed by graduate teaching assistants or the instructor, not others, and we will respond to in a timely fashion. If the inquiry is too personal to submit through this form, please submit a note through the form indicating that fact and also contact the instructor directly by email.

In particular, do not use Campuswire Direct Messages (DMs) to contact me (Brian) – I do not check them regularly.

Course staff typically respond to CampusWire questions within about one business day. I (Brian) do not guarantee that I will respond to communications after about 5pm or on weekends. Course staff tend to get a high volume of questions when a deadline is approaching. If you contact us at least two full business days before an exam or deadline, you are guaranteed a reply before the exam or deadline. Otherwise we’ll do our best, but no guarantees.

There is a course contact form, linked to on the Moodle page, where all special requests should go. This course typically has an enrollment of around 80–100 students and almost 20 course staff.

CampusWire

CampusWire is a online discussion management system. It will be used as the main hub for questions and answers in this course. CampusWire is a great tool but it can be abused. Please follow these guidelines in your use of CampusWire to avoid abusing it:

The course staff will monitor CampusWire and answer your questions in a timely manner (generally within a business day or two). But do not expect us to provide real-time answers on CampusWire, especially in the last few hours before an assignment is due!

If a question has already been answered in a previous post we may not respond to you. If a question does not follow the guidelines above we may not answer it. If we find that a private question is relevant to a larger audience, we may make mark it public to help others in the course.

Time management and what to expect

As a general guideline, the university suggests that students spend an additional two to three hours outside of class time per credit hour. This is a three-credit course, therefore you should plan to spend six to nine hours a week on this class outside of lecture.

In a typical week, you will attend two lectures, complete a homework assignment which may involve significant reading, writing, and/or programming, and complete the assigned reading. This course is time consuming and will require your attention.

Schedule

Please see the course web site for a class-by-class schedule.

Grading criteria

The relative value of the various course components is approximately as follows:

You must achieve an average of 50% of higher on the exams to pass the class.

The numerical cutoff for final course letter grade assignment will be made after all grading is completed. As a rough guide, expect to require at least a 93 to get an A, a 90 to get an A-, an 87 to get a B+, an 83 to get a B, an 80 to get a B-, and so on.

There are no unannounced opportunities for extra credit in this course; please, do not ask.

Here’s how grading works for the in-class clicker questions. Each class is worth 20 points. If you answer at least 50% of the questions correctly, you get all 20 points. Otherwise, you get 10 points (basically for showing up). I’ll drop your two lowest scores including excused absences. Using someone else’s clicker will result in an academic dishonesty charge for both of you and sanctions up to and including failure for the course.

Assignments are not accepted late. If you need an individual extension due to calamity allowed for by UMass policy (illness, trauma, death in the family, etc.), I will require documentation of the calamity.

Assignments and exams will be returned on gradescope (or a similar service) and thus we do not retain materials much after when grades are due.

You are responsible for monitoring your grades. Grades will be available through Gradescope and you should check them regularly and review any provided feedback. If you encounter any issues with your grades, you will have one week past the first posting of a particular assignment’s grade to Moodle to contact the course staff so that we can investigate. Please contact us via a private message on CampusWire. We will not generally accept questions about an individual assignment’s grade beyond this one week, so you must be prompt.

Assignments

The majority of the workload in this course will consist of take-home assignments. These assignments will involve writing, programming, or both. Written assignments will have a series of questions, and will require that you understand basic legal and technical concepts to answer them correctly. Some written assignments will require detailed analyses (for example, reasoning about a particular technology in the context of a law). Programming assignments will typically involve implementing a forensic tool from scratch using Python. Assignments are not collaborative: you must complete them on your own. Exceptions to this rule will be clearly noted.

We plan to give about 10 assignments (more or less, depending upon how written and programming assignments are broken up or combined into single assignments).

Each assignment will contribute a stated number of points toward the “Assignments” portion of your course grade. Each assignment may be worth a different amount of points.

Attempts to manipulate, game, or otherwise incorrectly use the autograder will be treated as academic dishonesty.

Midterms and exams

There will be one at-night midterm.

There will also be a cumulative final exam.

You must achieve an average of 50% of higher on the exams to pass the class.

Please note (from the Academic Rules and Regulations):

…it is University policy not to require students to take more than two final examinations in one day of the final examination period. If any student is scheduled to take three examinations on the same day, the faculty member running the chronologically middle examination is required to offer a make-up examination if the student notifies the instructor of the conflict at least two weeks prior to the time the examination is scheduled. The student must provide proof of the conflict. This may be obtained from the Registrar’s Office, 213 Whitmore.

You may not bring supplemental material to the midterms or final exam, that is, they are closed-book, and the use of notes, calculators, computers, phones, etc., is forbidden, unless otherwise explicitly stated.

Exams must be completed on your own: they are not collaborative!

Attendance

I expect you to attend lectures (and exams!).

If you must miss a test for a documented, excusable reason, I will work with you to find an acceptable time for you to take a makeup. If you miss an exam without prior notice, I will require an explanation and clear written documentation in order to judge whether the absence is excusable.

Incompletes

Incompletes will be granted only in exceptional case, according to the university policy, and only if you have completed at least half the course with a passing grade. Prior to that, withdrawal is the recommended course of action.

Technology in the classroom

Laptops are not allowed in class as they are distracting. It is unfair to distract other students with Facebook feeds, animated ads, and the like. Research suggests that students who take written notes in class significantly outperform students who use electronic devices to take notes. You may take notes with a tablet using a stylus but not a keyboard attached to a tablet. Students with accommodation notices are of course exempt from this rule; please show me official documentation.

Recording of video or audio of the lectures and in-class time and discussion is strictly forbidden.

Offensive topics and materials

This class will occasionally involve discussion of real-life court cases and criminal scenarios. My own professional work involves forensic investigation of crimes against children, and this topic will come up during the semester. You may find some topics of discussion distasteful, offensive, disturbing, and shocking, which is atypical for Computer Science. For example, we may discuss true and hypothetical scenarios and cases of child sexual exploitation, adult pornography, homicide, and other violent crimes. You are welcome to sit out for any discussion if you feel uncomfortable, no questions asked, no need to ask ahead of time. I will try to keep all discussions at a high level and to give clear warning when we’re about to discuss potentially offensive material (and you should do the same) but it is inevitable that there will be some frank discussion in lecture, and some court decisions referenced or read will contain candid language.

Academic honesty

General academic honesty statement

Since the integrity of the academic enterprise of any institution of higher education requires honesty in scholarship and research, academic honesty is required of all students at the University of Massachusetts Amherst. Academic dishonesty is prohibited in all programs of the University. Academic dishonesty includes but is not limited to: cheating, fabrication, plagiarism, and facilitating dishonesty. Appropriate sanctions may be imposed on any student who has committed an act of academic dishonesty. Instructors should take reasonable steps to address academic misconduct. Any person who has reason to believe that a student has committed academic dishonesty should bring such information to the attention of the appropriate course instructor as soon as possible. Instances of academic dishonesty not related to a specific course should be brought to the attention of the appropriate department Head or Chair. Since students are expected to be familiar with this policy and the commonly accepted standards of academic integrity, ignorance of such standards is not normally sufficient evidence of lack of intent.

Please read the UMass Academic Honesty Policy.

Course-specific academic honesty information

Academic dishonesty is usually the result of other problems in school. Please come see me or the TA if you are unable to keep up with the work for any reason and we will do our best to work something out. I want to see you succeed, but I will not tolerate academic dishonesty.

Investigating academic dishonesty is an unpleasant experience for both the instructor and the student. Please help me by avoiding any questionable behavior.

What is permitted and what is not? You may discuss material with others, but when collaboration is forbidden (as it is on programming assignments), your writing (code and prose) must be your own.

The surest way to avoid problems is as follows: When discussing problems with others, do not show any of your solution (code or otherwise) to others. In particular, do not sit down and start typing on a classmate’s laptop, do not allow a classmate to type on yours, and don’t act as a dictation machine (where a classmate sitting next to you tells you what to type).

When asking others for help, avoid taking detailed notes about the solution – you want to avoid doing a copy/paste, whether it be on a computer screen or using pen and paper.

When you ask for help, either in person or on CampusWire, it’s good practice to ask your question by describing the problem you’re having, or using a small synthetic example that illustrates your difficulty. If you must include a large chunk of your code to ask your question on CampusWire, mark it as a “private” question, and only the course staff will be able to see it.

When searching for the answer online: Don’t. Just don’t.

Do not provide your solutions to others, either directly or via some sort of public posting, except when collaboration is explicitly permitted and when both you and the other person are currently enrolled in this course. Publicly or privately redistributing solutions to exercises, homeworks, or assignments for this course is a violation of the University Honesty Policy’s prohibition against facilitating academic dishonesty.

Copying and pasting code from another student or a third party is a violation of academic honesty, and we will endeavor to detect this by any means available to us, including automated similarity analysis of submitted assignments. Be aware that if something looks like academic dishonesty to us, we will treat it as such, unless you can provide strong evidence to the contrary. When in doubt, it is your responsibility to contact the course staff about whether a potential action would be considered academic dishonesty.

Other academic regulations

The Office of the Registrar publishes Academic Regulations yearly. You should be familiar with them. Particularly relevant are the policies on attendance, absences due to religious observance, and examinations.

ECHO 360

I am recording lectures via the ECHO 360 system. Every effort is made by the university to avoid capturing students’ likenesses, as the system is designed to capture the instructor and the front of the classroom. However, students’ audio participation may be recorded. If you walk in or out of the room when recording is active, you will likely be captured.

Please note that I am NOT making the recordings available to enrolled students. If you miss a particular class meeting, and it’s an excused absence, I can provide you with access to the recording for that day. If you are skipping a course meeting because of an unexcused absence then please make plans to get the notes from another student. And in this case, note that attendance is part of your grade and we use iClickers etc.

Accommodation statement

The University of Massachusetts Amherst is committed to providing an equal educational opportunity for all students. If you have a documented physical, psychological, or learning disability on file with Disability Services (DS), you may be eligible for reasonable academic accommodations to help you succeed in this course. If you have a documented disability that requires an accommodation, please notify me within the first two weeks of the semester so that we may make appropriate arrangements.

Using machine learning to complete assignments is academic dishonesty

I want to be clear that you are not allowed to use any AI/machine learning tools to complete assignments in this course.

You can’t enter assignments in chatGPT and ask for answers.

You can’t use co-pilot to code or anything that generates automatically code for you.

Or anything similar.

If you do, then it’s an instance of academic dishonesty and I will pursue sanctions up to and including failing the course.

Your work must be your own.

A word about putting your solutions on GitHub, GitLab, BitBucket, etc.

Per the course-specific academic honesty policy, you are not permitted to make your solutions to the assignments in this class available to others. This includes re-posting them to public GitHub repositories (or other service where another student might plausibly see them).

A word about copyrights

Most of the material (lecture notes, lectures, assignments, and so on) in this course is original work created by the instructors past and present (Brian Levine and Marc Liberatore); exceptions are clearly noted (for example, I am not Brian Carrier and did not write the textbook!). While you are welcome to use the material for your own personal and educational use, you may not redistribute these materials to others outside the class. In particular, selling or otherwise redistributing your notes (or mine!), making or selling audio, video, or still recordings of course material, is not allowed without express written permission from me.

I make this stuff available on the web for you to use easily and without the hassle of sign-ups, logins, and the like, not for you to abuse for a buck. As Carol Barr (Senior Vice Provost and Dean of Undergraduate Education) and Enku Gelaye (Vice Chancellor for Student Affairs and Campus Life) noted at the start of the Fall 2017 semester, usage of notes or in-class recordings without the faculty member’s permission is a violation of the faculty member’s copyright protection.

And on Sept 1 2022, Farshid Hajir, Senior Vice Provost & Dean of Undergraduate Education, announced: “UMass has consulted with legal counsel and have received the following guidance: instructors can tell students that they can only use class notes/recordings for their own personal use, and not share (sell) these notes via an outside vendor or entity without the instructor’s permission. Usage of the notes or in-class recordings in this way without the faculty member’s permission is a violation of the instructor’s copyright protection.”

Further, notes, videos, etc. shared with students receiving the accommodations are explicitly for use only by that student and are not to be distributed to other students or third-party sites.

These policies above apply in this course. Do not upload my materials to third party sites for the purposes of sharing and/or academic dishonesty.