FOR 340 - Operating System Forensics

This course explores forensic artifacts specific to Operating Systems (OS). Students will explore how user interactions with the system and processes can lead to the creation, alteration and/or destruction of traces, logs and artifacts on the underlying OS. Students are challenged to work individually and in groups to examine and prepare detailed reports showing the relevance of various artifacts from digital evidence. This course presents a higher level of technical detail and will balance theory and hands-on aspects for conducting digital forensic examinations.
Prerequisites FOR 240 with C or better
Credits: 3
ITS (Information Technology and Sciences)