Instructors: Prof. J Genetti
Office Hours: 208B Chapman T 2:00-3:00, WR 1:00-3:00 or by appointment
Phone/Email: 474-5737 / ffjdg
Class web page: http://www.cs.uaf.edu/~cs493
Prerequisite: CS321 or permission of instructor
Department policies: www.cs.uaf.edu/dms/Policies.html
Textbooks:
Forensic Discovery by Farmer & Venema
Incident Response and Computer Forensics (2nd edition) by Prosise, Mandia & Pepe

Overview:
Computer Forensics is an emerging area that uses procedure-centric approaches to cyber-attack prevention, detection, and incident response. Since no system can be 100% secure, we will study procedures to detect and gather court-admissible evidence using various forensic techniques.

Topics:

• Introduction to forensic science and digital evidence
• Computer security policies and guidelines
• Overview of forensic analysis software
• Legal/privacy aspects of computer forensics
• Documenting an investigation
• Non-networked computers
• Forensic duplication and analysis
• Networked computers
• Internet evidence and server logs
• Network surveillance
• Investigating unauthorized access to MS Windows machines
• Investigating unauthorized network access to UNIX machines

Grading Policy:
Final grades will be assigned based on the following percentage intervals:
A - [89.5%, 100%]
B - [79.5%, 89.5%)
C - [69.5%, 79.5%)
D - [59.5%, 69.5%)
F - [0.0%, 59.5%)

The assignments/exams will be weighted as follows:
Homework/Labs: 25%
Presentations: 25%
Exam 1 (open book, in class) on Tue Oct 11: 15%
Exam 2 (take home) due by 7:20pm on Tue Nov 22: 15%
Final Exam (open book, in class) on Thu Dec 15 at 5:45-7:45: 20%

Homework/Labs:
Homework/Labs will be assigned several times during the semester and are due by the start of class on the due date. Late assignments will not be accepted. Students may discuss possible approaches to problems, specific syntax questions, aspects of debugging and forensics software usage. However, all programs and written assignments are to be done strictly on an individual basis, unless otherwise specified.

Presentations:
During most class meetings, three students will each give a 10-15 minute presentation to the class and provide a 1-2 page written summary. The topics will be assigned 1 week in advance and range from expanding on a topic covered in class, addressing a defiency in the course books, reporting on a current event, to demonstrating a computer forensic technique. Each student must give three presentations during the semester and will be graded on correctness, completeness and clarity of the presentation/summary.

Exams:
In class exams may consist of any mix of multiple choice, short answer, program fragments and short essay questions. Take home exams will also include some programming. Your goal should be to demonstrate knowledge and understanding of course concepts.