Schedule

This page is a schedule of topics and readings. Lecture notes will often but not always be posted sometime following each lecture. Please remember that the notes (when available) are a supplement to, not a replacement for, attending class and taking your own notes. This schedule is approximate, and may change at my discretion (for example, if we spend more time on a particular topic than initially planned).

Each unit in the schedule will be approximately one week (two lectures); some units may take three or four lectures. I will update this schedule as the semester progresses.

Assignments and due dates are listed separately.

Unit 1: Introduction

Lectures

Required reading

Optional / supplemental reading

Unit 2: Carving, fragment recovery

Lectures

Required reading

Optional / supplemental reading

Unit 3: Hashing, streaming, sampling, and parallelism

Lectures

Required reading

Optional / supplemental reading

Unit 4: Filesystems

Lectures

Required reading

Optional / supplemental reading

  • Probably the best one-stop shop for FAT, NTFS, and Ext2/3 is the optional textbook for this class, Carrier’s File System Forensic Analysis; I suggest looking over the relevant chapters.
  • You may also find the relevant lecture notes from COMPSCI 365 useful for FAT and NTFS.
  • The Linux NTFS Documentation
  • As usual, Wikipedia has a general but dry introduction to each:

Unit 5: Network forensics

Lectures

Required reading

Optional / supplemental reading

Unit 6: Cloud and IoT

Lectures

Required reading

None this week, but you almost certainly want to at least flip through the optional reading!

Optional / supplemental reading

Unit 7: Mobile / Cell phone forensics

Lectures

Required reading

Unit 8: RAM forensics, reverse engineering

Lectures

Optional / supplemental reading

Final Exam

Our exam is scheduled for:

Thursday, May 9th, at 1pm in CS 140 (our regular classroom).

Please note (from the Academic Rules and Regulations):

…it is University policy not to require students to take more than two final examinations in one day of the final examination period. If any student is scheduled to take three examinations on the same day, the faculty member running the chronologically middle examination is required to offer a make-up examination if the student notifies the instructor of the conflict at least two weeks prior to the time the examination is scheduled. The student must provide proof of the conflict. This may be obtained from the Registrar’s Office, 213 Whitmore.