University of Technology Sydney

48436 Digital Forensics

6cp; 3hpw, online and on campus
Requisite(s): 48730 Cybersecurity
Anti-requisite(s): 32309 Digital Forensics
Recommended studies:

Confident with using Windows command line utilities such as netstat, nslookup, net and ipconfig. Also confident with Linux command line tools such as grep, ls, uname and ps.



This is a practice-based subject, using material based on the textbook. Learning is laboratory-based. Students assess if a crime has been committed, acquire digital evidence, analyse the evidence and prepare forensic reports.

The emphasis is on digital forensics applications, in particular:

  • forensic analysis of a digital storage device where evidence of visits to web sites is recovered to support or oppose a hypothesis before a criminal court
  • eDiscovery (a form of discovery related to civil litigation) where students acquire evidence of contact with a third party using email or social media
  • intrusion investigation into the nature and extent of an unauthorised network intrusion. Students look for evidence of malware being installed on the device that may use the network to exfiltrate data to an unauthorised person.

Typical availability

Spring session, City campus

Detailed subject description.

Fee information

Information to assist with determining the applicable fee type can be found at Understanding fees.

Access conditions

Note: The requisite information presented in this subject description covers only academic requisites. Full details of all enforced rules, covering both academic and admission requisites, are available at access conditions and My Student Admin.