Syllabus~IS 238 Computer Forensics III

Instructor: Kris Townsend
Office Phone: 533.3246
Email: krist at spokanefalls.edu

Class Hours: RF 10:30 — 1:00
Office: 18-112A

Class Web Site

» http://faculty.spokanefalls.edu/ktownsend/IS238
»Moodle: http://www.sfcc-iscs.us

Required Text and Materials

» none

Course Description

Students learn to provide a secure computer environment and learn
techniques for collecting and analyzing computer-related evidence. This
class is designed to train computer technicians in the elements of computer forensics investigation.
» CSS Catalog

Prerequisites

» IS 164, IS 236

Course Outcomes

Investigate a case as a capstone project including writing the affidavit, acquiring, analyzing, reporting, and testifying in court.
Analyze system artifacts using EnCase and Forensic Toolkit for common operating systems: Windows XP, Windows 7, Linux, and OS X.
Learn overt and covert analysis techniques that can be used by a network administrator

Policies

Be responsible

Be professional. Your enrollment in this class indicates that you plan to work professionally in a technical field. That professionalism needs to start now, not then.
Do your own work. Working with others to solve problems and foster learning is encouraged. Blindly relying on the work of others is discouraged and considered cheating. Cheating is grounds for assigning a failing grade and it can be placed in your academic record.
Use your lab time to complete assigned tasks. The class is designed for students to work together on a common set of problems and challenges in the presence of an instructor and to use the special forensics equipment available during class times. Missing class or using class time to work on other projects greatly increases your risk for poor quality work or failure.
If you miss class, catch up before the next class. Waiting to catch up during the next class places the entire class at a disadvantage.
It is a courtesy to contact your instructor via email before missing a 3rd consecutive day. I don't want to hear excuses, but I do want to know what your plan is for returning and catching up.

Make-ups / Late Work

Late work is not accepted, so plan to finish early. Waiting to the last minute places your success at risk.
Your report for the case cannot be late, presentations cannot be made up, and your evaluation of student presentations cannot be made up.
Because emergencies happen, if you must miss a deadline or point scoring opportunity, you may be assigned extra wiki articles at the discretion of the instructor.
Absence is not an excuse for missing deadlines. Use an alternate means of conveyance to submit your work. For example, a case report can be emailed, dropped off on CD, or submitted to Blackboard.

Conduct yourself with courtesy, respect, and consideration for others.

During direct instruction (lectures, demonstrations, student presentations, etc.), I do not want to share your attention with others. Engaging yourself with the computer or other electronic devices during direct instruction is distracting to other students and rude. You may be asked to leave at the discretion of the instructor.
Leaving the class for food or a smoke during direct instruction is not allowed.
Food and drink are not allowed in the computer classroom.

Manage Your Files

Backup your work early and often. Keep a backup of your case file on another partition and back up your case folder on a second drive at least every other week.
Corrupted disks and computer failure will not be considered an acceptable excuse for missing your due date.

SFCC Statement on Diversity

In order for learning to take place, students must feel safe; this safety is due all students, not only those who share your values and beliefs. For this reason, courtesy, thoughtfulness, and acceptance are essential in our discussions in and out of the classroom. Acceptance should not be confused with agreement; one need not agree with a person to listen, and one must listen well in order to disagree respectfully. Every student in this course has a voice and so deserves the courtesy of attentive listening and the freedom to express diverse ideas.

Disability Support Services

If you have a health condition or disability that may require you to have accommodations in order to effectively participate in this class, please contact the Disability Support Services in Building 17, Room 201 (Phone 533-4166). Information about conditions or disabilities will be regarded as confidential.

Grading

EnCase HOWTO	Wiki page(s)	30
	Presentation	25
	Evaluation of 4 presentations	20
Covert/Overt Analysis HOWTO	Wiki page(s)	25
	Presentation	25
	Test/Edit another page(s)	25
Strange Case	Affidavit(s)	50
	Report	50
	Witness in court	50
	Defense in court	50
	Jury participation	50
Shopping Spree		100
	Total	500

Important Dates

April 9: Start EnCase HOWTO

April 17: Start Affidavit

April 23: Search and Seize Strange Case / EnCase HOWTO presentations

April 29: Start Overt/Covert HOWTO

May 7: Start Shopping Spree

May 14: Overt/Covert HOWTO Presentations

June 4: Reports turned over to defense lawyer

June 11 and 12: Court

June 15: Shopping Spree due / Test and Edit due