Schedule

This page is a schedule of topics and readings. Lecture notes will often but not always be posted sometime following each lecture. Please remember that the notes (when available) are a supplement to, not a replacement for, attending class and taking your own notes. This schedule is approximate, and may change at my discretion (for example, if we spend more time on a particular topic than initially planned).

Each unit in the schedule will be approximately one week (two lectures); some units may take three or four lectures. I will update this schedule as the semester progresses.

Assignments and due dates are listed separately.

Unit 1: Introduction

Lectures

Required reading

Optional / supplemental reading

Unit 2: Carving, fragment recovery

Lectures

Required reading

Optional / supplemental reading

Unit 3: Hashing, streaming, sampling, and parallelism

Lectures

Required reading

Optional / supplemental reading

Unit 4: Filesystems

Lectures

  • 09: FAT and NTFS
  • 10: Ext2/3/4
  • 11: ZFS

Required reading

Optional / supplemental reading

  • Probably the best one-stop shop for FAT, NTFS, and Ext2/3 is the optional textbook for this class, Carrier’s File System Forensic Analysis; I suggest looking over the relevant chapters.
  • You may also find the relevant lecture notes from COMPSCI 365 useful for FAT and NTFS.
  • The Linux NTFS Documentation
  • As usual, Wikipedia has a general but dry introduction to each:

Prioritized analysis

Visualization

Cloud and IoT

Mobile

RAM

Reverse engineering

Final Exam

Our exam is scheduled for:

Thursday, May 9th, at 1pm in CS 140 (our regular classroom).

Please note (from the Academic Rules and Regulations):

…it is University policy not to require students to take more than two final examinations in one day of the final examination period. If any student is scheduled to take three examinations on the same day, the faculty member running the chronologically middle examination is required to offer a make-up examination if the student notifies the instructor of the conflict at least two weeks prior to the time the examination is scheduled. The student must provide proof of the conflict. This may be obtained from the Registrar’s Office, 213 Whitmore.