MCF8214 File Systems Forensic Analysis

This course gives students an overview of file system forensics.  Students will learn techniques to preserve and analyze digital evidence, and to reconstruct a timeline of events relevant to an investigation.  Students will employ professional digital forensic investigative procedures to ensure that evidence collected meets legal standards.

Course objectives

This course aims to provide students with the knowledge and skills to perform forensic analysis of file systems of storage devices. It covers forensic analysis of different file systems such as FAT, NTFS and Linux file systems, and the reconstruction of digital evidence from storage devices.

Learning outcomes
Upon successful completion of this course, students will be able to:

• Identify the need and the procedure for the validation of tools used in forensic analysis 
• Perform volume analysis of hard disks and other storage devices
• Apply forensic analysis to different file systems such as FAT, NTFS and Linux file system
• Reconstruct a timeline using digital evidence from storage devices to correlate digital events with physical events