Networked Forensic Investigation

2020/21
Level 6 Semester B
MODULE HANDBOOK
Contents
What this Module is About………………………………………….…………….3
Schedule of Work………………………………………………………………….5
Key Resources to Support Learning………………………………….…………6
Assessment…………………………………………………………………………6

1 What this Module is About:
This module will introduce you to the relatively new area of Digital Forensics Investigation of Networked based digital devices. There is a great industry needs in digital mobile forensics investigation due to the advances in mobile technologies and its continuous development, as well as security and privacy issues in this field. Students will learn about underpinning knowledge in smart phone mobile forensics investigation, conducting chain of custody in mobile forensic investigation, identification of likely areas for evidence recovery, analysis of digital media and tools and techniques used by forensic agencies. Practical task and tutorials will be used to re-enforce and apply theory to encourage an analytical and problem based approach to forensic investigation.
Module leader:
Name: Dr. Pooneh Bagheri Zadeh (Module Leader)
Email: P.Bagheri-Zadeh@leedsbeckett.ac.uk
Room: Caedmon Hall, 210
Phone: 0113 81 23760

Module Aim
This module aims to provide you with a hands-on in-depth view of the nuances of the analysis of alternative sources of digital evidence, beyond that of the standard computer. These sources are becoming more prevalent in today’s world; including satellite navigation systems, mobile phones and networked environments.
Module Learning Outcomes
On completion of this module you should be able to:
1. Develop a critical understanding of the variety of evidence available from networked digital devices
2. Perform detailed analysis of a variety of networked digital devices using appropriate forensic tools and techniques.
3. Develop a critical understanding of the ways of retaining evidence continuity and the correct methods for collecting networked forensic evidence.

2 Weekly Schedule
The following table is the intended teaching schedule for this module, this may change. We will attempt to keep to this schedule and inform you of any changes.
Week W/C Lecture Lab
1 11/01/2021 Introduction to the module and assessment, Recap Handset and SIM card forensics XRY recap, SIM card and phone data analysis, Exporting and reporting.
2 18/01/2021 Android Artefacts Android Forensics
3 25/01/2021 iOS Artefacts iOS Forensics
4 01/02/2021 iOS Artefacts iOS Forensics
5 08/02/2021 Continuity and visualisation: other prospective Continuity, introduction to visualization
6 15/02/2021 Satellite navigation evidence and presentation Satellite data extraction and recovery
7 22/02/2021 Advances in mobile forensic investigation Advanced Mobile Forensics
8 01/03/2021 Drone Forensics Drone Forensics
9 08/03/2021 EXAM Week EXAM PRESENTATION
10 15/03/2021 EXAM Week EXAM PRESENTATION

3 Key Resources to Support Learning
The following literature is specific to the Computer Forensics and Computer Security based modules you will study. No modules are based directly on a book or a resource; a number of resources are suggested to provide supporting structure to what you are taught.
It is important that you read around the subject area and don’t just rely on what you are taught within a module – you are here to learn and we will provide you with the guidance to do this. Those students who engage fully with material outside of the teaching periods will generally achieve higher marks than those who don’t. Those students will also perform better at employer assessed exercises, be better able to answer questions at interview and be more likely to gain employment in their chosen field.
Leeds Beckett has an excellent library resource that stocks a vast number of books in this subject area so do not feel the need to purchase these books. Once you have started a module and have accessed the library you will get a better feel for the books you may wish to purchase. The ISBN number, the Library Classmark and the number of copies in Leeds Beckett Headingley Library are provided to help you to locate books. Most of them can also be accessed via the “Resource List” link on MyBeckett.
4 Assessment
4.1 Assessment Overview
● Component 1: Exam with presentation, 50%, PowerPoint presentation and 10 minutes recorded presentation; submission due on Sunday 7th March 2021, before 23:59, Electronic submission through MyBeckett. 2 minutes Q&A in week commencing 8th March 2021, through SKYPE for Business individual timeslots – a schedule will be published on MyBeckett.
● Component 2: Phase Examination 50%, 60 minutes, in week commencing 15th March 2021, Online on Mybeckett.
● Reassessment Component 1: Exam with presentation 50%, due on TBC, Electronic submission through MyBeckett.
● Reassessment Component 2: Phase Examination 50%, 60 minutes, TBC
4.2 Assessment Brief
4.2.1. Component 1: Practical Exam with presentation
MAIN Component 1: COURSEWORK
Module name and CRN Networked Forensic Investigations (NFI), CRN: 14455
Module Leader Dr. Pooneh Bagheri Zadeh
Semester B Level 6 Approx No of Students 96
COMPONENT TITLE: Practical Exam with presentation
COMPONENT WEIGHTING: 50% of Module Marks
HAND-OUT DATE: W/C 01/02/2021
SUGGESTED STUDENT EFFORT: 20 hours
SUBMISSION DATE: PowerPoint Presentation and 10 minutes recorded presentation submission on 07/03/2021 23:59
2 minutes Q&A schedule (W/C 8th March 2021)– a schedule will be published on MyBeckett.
SUBMISSION INSTRUCTIONS:
Turnitin upload via MyBeckett
FEEDBACK MECHANISM: Electronic Feedback within 3 weeks of submission
● Typed feedback distributed by emails
LEARNING OUTCOMES ADDRESSED BY THIS COMPONENT:
● Develop a critical understanding of the variety of evidence available from networked digital devices
● Perform detailed analysis of a variety of networked digital devices using appropriate forensic tools and techniques.
● Develop a critical understanding of the ways of retaining evidence continuity and the correct methods for collecting networked forensic evidence.
NOTES:
The usual University penalties apply for late submission.
This is an individual assessment. Submission of an assessment indicates that you, as a student, have completed the assessment yourself and the work of others has been fully acknowledged and referenced.
By submitting this assessed work, you are declaring that you are fit to submit, and you will therefore not normally be eligible to submit a request for mitigation for this work.
If your result for this assessment is recorded as Non-Submission or your mark for this assessment and for the whole module is below 40%, you will have opportunity to take reassessment with a submission date TBC and your mark capped at 40% (see Reassessment information below). If you are granted deferral through the mitigation process, you may complete the reassessment with a full range of marks available.
For further information, please refer to your Course Handbook or University Assessment Regulations.
DETAILS OF THE ASSESSMENT
Students are expected to put into practice what they have learnt during the lecture and practical lab sessions and present the findings (similar to talking to a client) in a form of recorded presentation. Each Student will be allocated 2 minutes Q&A for questions to be asked.
Pieces of evidence from two mobile device will be provided through MyBeckett. This evidence will include complex data that will require successful interpretation and presentation to allow a layperson to understand what it is the student has found. Using the tools and techniques that have been learnt in the module, and any outside reading, each student must utilise relevant techniques to successfully answer the “customer’s” questions – this will require the use of data visualisation techniques and systems.
The presentation should be designed as if it were to be presented to a police authority who are looking to identify suspects. The audience have no knowledge of forensics but have some understanding of the data recoverable from mobile devices. Students therefore need to present the findings with the layperson in mind.
The deadline to submit the presentation is by 23:59 on Sunday 7th March 2021 via the link on MyBeckett. Presentation should be in .ppt or .pptx ONLY. You need to also record your presentation (your PowerPoint presentation on the screen and your voice talking on each slide) and submit the recorded file or a link to download the recorded file by 23:59 on Sunday 7th March 2021. A 2 minutes Q&A will be scheduled for each student on W/C 8th March 2021 (a schedule will be published on MyBeckett).
Scenario
As part of Operation BUMBLEBEE, surveillance is being carried out at a warehouse in Churchill Lane Industrial Estate, from which an organised crime operation is suspected to be being co-ordinated; the criminal activities include drug and people trafficking operation.
Following additional intelligence investigation two mobile phones were recovered by covert officers and CDR records requested from the network operators.
The information was recovered and is now submitted for immediate investigation as follows:
● PBZ1-Extraction from recovered mobile phone 1
● PBZ2-Extraction from recovered mobile phone 2
● PBZ3-CDR-IN
● PBZ4-CDR-Out
● PBZ5-UK Location Data
You are tasked with the analysis of all of the data provided to attempt to give the investigators information along with the following:
● A clear time-frame
● The time, type and content of communication
● Location of the device(s) in your time frame
● Places of interest
● Identification of the perpetrator(s)
● Identification of victim(s)
Remit of the investigation
Dates and times are vital for this investigation, much of the evidence contains lots of information (covering a wide timeframe), students must therefore decide on a period in which to focus the analysis.
Once the date and time of interest are identified and reviewed, the selected data should be visualised in the identified period. Students are attempting to show links between the data and the people, as a minimum – answers to the following list is a minimum:
● The time, type and content of communication
● Location of the device(s) in your time frame
● Places of interest
● Identification of the perpetrator(s)
● Identification of victim(s)
Recorded Presentation Overview
As part of your presentation you will need to cover, as a minimum (time estimates are provided as guidance):
● Introduction covering what the “customer” has asked to be done (1 minute)
● Your findings including the visualised data – presented as if to the customer (8 minutes)
● Conclusions (1min)
● 2 minutes for Q&A from your tutors (will be arranged on W/C 8th March)
MARKING SCHEME / CRITERIA
● Introduction 10%
● Evidence presentation 70%
o Evidence identification including the device identification
and the available evidence (40%)
o Tools and techniques used to process the evidence (15%)
o Discussion on visualized data (15%)
● Conclusion 10%
● Presentation quality and timing 10%
REASSESSMENT and DEFERRAL OPPORTUNITIES
Students who are required to complete this component as reassessment or deferral will be required to follow the original report brief.
4.2.2 Component 2: Phase EXAMINATION.
Module name and CRN Networked Forensic Investigations (NFI), CRN: 14455
Module Leader Dr. Pooneh Bagheri Zadeh
Semester B Level 6 Approx No of Students 96
COMPONENT TITLE: 60 minutes Phase Examination
COMPONENT WEIGHTING: 50% of Module Marks
HAND-OUT DATE: Week commencing 15th March 202, online exam on MyBeckett.
SUGGESTED STUDENT EFFORT: 20 hours
SUBMISSION DATE: Week commencing 15th March 202, online exam on MyBeckett.
SUBMISSION INSTRUCTIONS:
MyBeckett upload
FEEDBACK MECHANISM: Electronic Feedback within 3 weeks of submission
Typed feedback via MyBeckett,
LEARNING OUTCOMES ADDRESSED BY THIS COMPONENT:
● Develop a critical understanding of the variety of evidence available from networked digital devices
● Perform detailed analysis of a variety of networked digital devices using appropriate forensic tools and techniques.
● Develop a critical understanding of the ways of retaining evidence continuity and the correct methods for collecting networked forensic evidence.
NOTES:
The usual University penalties apply for late submission.
This is an individual assessment. Submission of an assessment indicates that you, as a student, have completed the assessment yourself and the work of others has been fully acknowledged and referenced.
By submitting this assessed work, you are declaring that you are fit to submit, and you will therefore not normally be eligible to submit a request for mitigation for this work.
If you fail to attend the online test at the scheduled date and time without agreed mitigation, your result will be recorded as Non-Submission. If your result is recorded as Non-Submission or your mark for this assessment and for the whole module is below 40%, you will have opportunity to take reassessment in w/c TBC and your mark capped at 40% (see Reassessment information below). If you are granted deferral through the mitigation process, you may take the reassessment online test with a full range of marks available.
For further information, please refer to your course handbook or University Assessment Regulations.
DETAILS OF THE ASSESSMENT
This assessment is an online exam. The exam will be available via MyBeckett and students will have one (1) attempt during w/c 15th March 2021. The duration of the exam is 60 minutes.
You will have access to all of your notes (hand-written, printed, and electronic), and you may access your electronic notes and data conversion sites (where appropriate). You may not use any printed textbooks and you must not communicate with anyone by any means, electronic or otherwise.
This assessment will be a series of short answer and multiple-choice questions including the analysis of a number of Forensic Images and extracted data from several digital devices to identify information from within various files and folders; this includes the theoretical knowledge covered in the module. You will be required to answer a series of questions via MyBeckett: it requires knowledge of the process of analysis and interpretation of the findings, as expected of a Forensic Analyst, as well as the understanding of the preservation of evidence.
4.2.3 Reassessment Component 1: Practical Exam with presentation
Module name and CRN Networked Forensic Investigations (NFI), CRN: 14455
Module Leader Dr. Pooneh Bagheri Zadeh
Semester B Level 6 Approx No of Students 96
COMPONENT TITLE: Practical Exam with presentation
COMPONENT WEIGHTING: 50% of Module Marks
HAND-OUT DATE: W/C 01/02/2021
SUGGESTED STUDENT EFFORT: 20 hours
SUBMISSION DATE: TBC
SUBMISSION INSTRUCTIONS:
Turnitin upload via MyBeckett
FEEDBACK MECHANISM: Electronic Feedback within 3 weeks of submission
● Typed feedback distributed by email
LEARNING OUTCOMES ADDRESSED BY THIS COMPONENT:
● Develop a critical understanding of the variety of evidence available from networked digital devices
● Perform detailed analysis of a variety of networked digital devices using appropriate forensic tools and techniques.
● Develop a critical understanding of the ways of retaining evidence continuity and the correct methods for collecting networked forensic evidence.
DETAILS OF THE ASSESSMENT
Please follow the instruction in the assessment brief at Page 4 of this document.
4.2.4. Reassessment Component 2: Phase EXAMINATION.
Module name and CRN Networked Forensic Invesitgations (NFI), CRN: 14455
Module Leader Dr. Pooneh Bagheri Zadeh
Semester B Level 6 Approx No of Students 96
COMPONENT TITLE: 60 minutes Phase Examination
COMPONENT WEIGHTING: 50% of Module Marks
HAND-OUT DATE: TBC
SUGGESTED STUDENT EFFORT: 20 hours
SUBMISSION DATE: TBC
SUBMISSION INSTRUCTIONS:
Turnitin upload via MyBeckett
FEEDBACK MECHANISM: Electronic Feedback within 3 weeks of submission
● Typed feedback via MyBeckett,
LEARNING OUTCOMES ADDRESSED BY THIS COMPONENT:
● Develop a critical understanding of the variety of evidence available from networked digital devices
● Perform detailed analysis of a variety of networked digital devices using appropriate forensic tools and techniques.
● Develop a critical understanding of the ways of retaining evidence continuity and the correct methods for collecting networked forensic evidence.
DETAILS OF THE ASSESSMENT
Please follow the instruction in the assessment brief at Page 12 of this document
Order Now

Calculate a fair price for your paper

Such a cheap price for your free time and healthy sleep

1650 words
-
-
Place an order within a couple of minutes.
Get guaranteed assistance and 100% confidentiality.
Total price: $78
WeCreativez WhatsApp Support
Our customer support team is here to answer your questions. Ask us anything!
👋 Hi, how can I help?