Open Source Forensics

-Linux operating system, commands, and tools
-Linux filesystem and forensic artifacts
-Scripting and programming for investigators
-Building own forensic toolkit applications
-Forensic tool testing and quality assurance
-Linux analysis and data recovery techniques
-Investigation and forensic analysis
-Law and ethics
-Crime prevention policing

Knowledge
-After completing the course the candidate possesses knowledge of:
-The importance of open source software in the investigation
-New methods and techniques used in the investigation
-Legal and ethical issues
-Automation of techniques
-The benefit of being able to customize the tool in relation to specific challenges

Skills
-After completing the course the candidate can:
-Utilize the potential of tools written in open source
-Master command interpreters
-Assess tools for adapting to different situations
-Develop Open source tools for efficient investigation within the rule of law
-Understand scripts written by others and adapt them to your context
-Validate proprietary and open tools

General Competence
-After completing the course the candidate can:
-Emerge with greater insight and confidence in the professional role
-Show personal responsibility for tasks in the investigation of electronic tracking
-Identify and evaluate ethical dilemmas in work performance
-See a record in a bigger prevention and investigation purposes

-Lectures
-E-learning
-Compulsory assignments
-Independent study

Additional information:
-Lectures and exercises delivered by PHS, through PHS´s digital learning system (Canvas/PingPong). PHS teacher and contactperson: Fergus Thomas Toolan.
-The course will be made accessible for remote students. It is organized as a web-based, online course where students can choose their own study time and follow their progress within the Autumn semester. The course workload is estimated to be approx. 280 hours. In the course student-centered learning activities on the internet are emphasized, including 10 online, on-demand lectures and the use of a virtual computer lab. The learning activities shall contribute to the learning outcome of the students, and in particular emphasize the relationship between theory and practice.In this course, students will build their forensic toolkit from scratch, which also takes place in a virtual environment. Throughout the course students will construct their forensic toolkit gradually and end with a complete machine that is specially adapted to needs of a digital forensic investigator. Students will be guided through the various required steps in the process.
-A distributed online learning platform at the Norwegian Police University College is used in the administration and implementation of the course.

The following course requirements must be met and approved before students can take the exam:
-Up to three tests related to specific topics

The course responsible and point of contact at PHS: Fergus Thomas Toolan. PHS offers a similar course in Open Source Forensic, possible to sign in before enrollment to the master program. Students who have passed the PHS course can apply for replacement of IMT4012-PHS when enrolled to MISEB.