MCF8116 Operating System Forensics

This course is concerned with forensic investigation of the most commonly used operating systems, including technical details of how each operating system works and how to find artifacts. Skills and knowledge of how to conduct successful digital forensic examinations in Windows, Linux, and Mac OS will be delivered

Course Objectives

In this course, learners will get the basic concepts of the working of the common OS as well as practical skills needed for forensic investigations basing on OS. Investigation of the key features of a modern operating system including process/thread scheduling and management, memory management, deadlock detection and avoidance, file management, disk scheduling and management, and some collection of advanced topics including security

Learning outcomes

At the completion of this unit students should be able to explain the operation and processes of OS; and demonstrate competence in controlling the operating environment and skills in tracking of computer/hardware, software and file access for safe use.