NETW236

This course provides a hands-on understanding of the methods, technologies, and challenges relevant to properly conducting a computer forensics investigation and response. Areas of study include procedures for investigating computer and cybercrime, and concepts for collecting, analyzing, recovering, and preserving forensic evidence. The course also covers working with various operating systems, including Windows, DOS, Macintosh, and Linux. Other topics covered include boot processes, disk structures, data acquisition, recovering image files, network forensics, being an expert witness, and reporting investigation results. This course requires three hours of lecture and additional independent lab time as necessary per week. (Prerequisites: NETW-106, NETW-107, and NETW-110 (or two of the three and department permission)