University of Technology Sydney

65325 Digital Trace and Identity

Warning: The information on this page is indicative. The subject outline for a particular session, location and mode of offering is the authoritative source of all information about the subject for that offering. Required texts, recommended texts and references in particular are likely to change. Students will be provided with a subject outline once they enrol in the subject.

Subject handbook information prior to 2020 is available in the Archives.

UTS: Science: Mathematical and Physical Sciences
Credit points: 6 cp
Result type: Grade and marks

Description

This subject introduces students to the underlying principles and applications of digital forensic science. Students learn about the development and expansion of the role of digital forensic science over the past few decades. Students become aware of the digital traces they leave behind in their own lives and how these traces can be used to assist in the investigation of crime and understanding criminal phenomena. The material presented challenges ideas in regard to identity in the digital realm and how it differs from traditional understandings of identity. Students develop their practical digital investigation skills through the use of computer laboratory classes.

Subject learning objectives (SLOs)

Upon successful completion of this subject students should be able to:

1. Explain the importance of digital traces to modern forensic science and evaluate their value in the investigative process
2. Apply forensic science principles to digital traces and investigations
3. Identify and describe common security features and vulnerabilities across digital devices and systems (including mobile phones)
4. Recognise and apply the appropriate tools to identify, acquire and analyse digital traces for investigative purposes
5. Communicate complex findings from investigations and generate an expert witness report

Course intended learning outcomes (CILOs)

This subject also contributes specifically to the development of following course intended learning outcomes:

  • Apply: Demonstrate a command of forensic science practice, including the detection, collection, and analysis of traces using current, appropriate, and emerging processes and technologies. (1.1)
  • Analyse: Evaluate the collection of traces and interpret the results of analyses through the use of propositions, hypotheses, and statistical methods. (1.2)
  • Apply: Employ investigative and problem-solving skills to evaluate forensic science problems. (2.1)
  • Analyse: Critically analyse and evaluate data, experimental results, and academic literature. (2.2)
  • Apply: Practice safe, responsible, and professional conduct in laboratory and practical settings. (3.1)
  • Analyse: Practise professional ethical conduct through work-integrated learning. (3.2)
  • Synthesise: Discuss the impact and role of forensic science in addressing current and future challenges faced by law enforcement, the legal system, security, and the wider community. (3.3)
  • Apply: Demonstrate skills in case documentation. (5.1)
  • Synthesise: Explain experimental findings to communicate conclusions, expert opinion, and the justification of professional decisions effectively to expert, scientific, and non-expert audiences. (5.3)

Contribution to the development of graduate attributes

1. Disciplinary knowledge

Students will learn how digital traces are generated, detected and analysed for forensic purposes. By acquiring an understanding of a wide range of operating systems, students will be able to apply this knowledge to digital investigations. Students will be introduced to the fundamentals during the lectures, and will have an opportunity to apply to this during the computer lab classes. Feedback on the students’ knowledge will be provided during the computer laboratory sessions. Students will be assessed on their discipline knowledge and their ability to apply it in assessment tasks 1,2 and 3.

2. Research, inquiry, and critical thinking

During the computer laboratory classes, students will need to develop their investigative and problem solving skills in order to determine the best way to identify and process digital traces. During the first few computer labs students will be guided through the investigative process, after these initial classes students will then apply these skills to a range of different specialized laboratory classes that will require students to apply their problem solving skills to each simulated digital investigation. Students will be provided feedback during the computer lab classes through verbal and written feedback on their investigations. Students will be assessed on this in assessment task 3.

3. Professional, ethical, and social responsibiliy

Students will gain awareness and experience in digital investigation processes and techniques in the lectures and computer laboratory sessions. Students will have an opportunity to implement these skills during the computer laboratory sessions where they will be completing activities to simulate a digital forensic science investigation. During these sessions students will received informal verbal feedback from the instructor. Students will be assessed on these skills in assessment tasks 2 and 3.

5. Communication

The communication skills developed in this subject are essential for the student to be able to translate the complex ideas to a lay audience. The ability to transform complex jargon and findings are necessary for a digital forensic scientist to possess. During the computer laboratory classes, students will be completing activities that will require them to report their findings in the form of an expert witness report. Students will receive feedback on their written communication skills through the weekly computer lab activities. Students will be assessed on this ability in assessment task 3.

Teaching and learning strategies

Students will attend a series of weekly lectures and computer laboratory classes in this subject.

Lectures

Lectures will be two hours per week. These classes will introduce students to the key theoretical concepts of the subject. Lectures will provide an opportunity for the students to question and clarify any of the subject material. It is expected that students read the lecture material before coming to class to allow for engaging classroom discussion. Students will discuss in small groups the case scenario presented and analyse the potential digital traces and suggest analysis strategies. All resources used in the lectures will be available through UTSOnline before the scheduled classes. Case studies and examples will be used in the lectures to help reinforce the application of the fundamentals of digital forensic science. The lectures are vital to supporting the students understanding for the computer laboratory classes.

Computer Labs

The computer labs will be two hours per week. Computer lab sessions provide students with the opportunity to apply the principles learnt in lectures. Students will work individually and collaboratively in the computer lab, developing their skills in digital forensic investigation processes using industry standard software. Attendance for the computer lab classes are compulsory as the activities completed in the labs are assessed as part of assessment task 2. During the classes students will receive feedback on their progress from the computer lab facilitator and from their completion of the computer lab activities.

An aim of this subject is to help you develop academic and professional language and communication skills to succeed at university and in the workplace. During the course of this subject, you will complete a milestone assessment task that will, in addition to assessing your subject-specific learning objectives, assess your English language proficiency.

Content (topics)

Computer Theory

Digital Forensic Science Process and steps

Types of records including Volatile data

Processing the Crime Scene for digital evidence

Forensic copy or ‘imaging’

Analysis of digital evidence

Analysis of Windows artefacts

Presenting and Reporting on digital evidence

Presenting and Reporting issues

Apple Mac & iOS artefacts

Internet and network evidence

Linux artefacts

Application artefacts

Windows artefacts II

Assessment

Assessment task 1: Quizzes

Intent:

This assessment task contributes to the development of the following graduate attributes:

1. Disciplinary knowledge

Objective(s):

This assessment task addresses subject learning objective(s):

2 and 3

This assessment task contributes to the development of course intended learning outcome(s):

1.1, 3.1 and 3.3

Type: Quiz/test
Groupwork: Individual
Weight: 20%
Criteria:

Correctness of answers chosen

Assessment task 2: Computer Lab Classes

Intent:

This assessment task contributes to the development of the following graduate attributes:

1. Disciplinary knowledge and its appropriate application
?3. Professional skills and their application
6. Communication skills

Objective(s):

This assessment task addresses subject learning objective(s):

1, 2, 3, 4 and 5

This assessment task contributes to the development of course intended learning outcome(s):

1.1, 1.2, 3.1 and 3.2

Type: Laboratory/practical
Groupwork: Group, individually assessed
Weight: 30%
Criteria:

Students will be assessed on their ability to:
- Demonstrate competency in recovering digital traces from devices

- Demonstrate and develop their problem solving abilities

- Explain and interpret the traces recovered as part of the lab activities

Assessment task 3: Practical Examination and Expert Report

Intent:

This assessment task contributes to the development of the following graduate attributes:

1. Disciplinary knowledge and its appropriate application

2. Inquiry oriented approach

3. Professional skills and their application

6. Communication skills

Objective(s):

This assessment task addresses subject learning objective(s):

1, 2, 3, 4 and 5

This assessment task contributes to the development of course intended learning outcome(s):

2.1, 2.2, 5.1 and 5.3

Type: Report
Groupwork: Individual
Weight: 50%
Criteria:

Students will need to apply an inquiry oriented approach and demonstrate a strong degree of problem solving skills to identify, analyse, process and report on the findings of their investigation.

Students will be assessed on their ability to:
Correctly identify and retrieve digital traces from a seized device

Apply the appropriate investigative tools

Communicate their findings in the form of an expert witness report

Minimum requirements

In order to be eligible for consideration for a pass in this subject, a student must achieve at least 40% in Assessment task 3 If 40% is not reached, an X grade fail may be awarded for the subject, irrespective of an overall mark greater than 50.

It is a requirement of this subject that you complete Assessment task 3. Should you receive an unsatisfactory English language level, you may be required to complete further language support after the completion of this subject.