Forensic Tool Development

The field of digital forensics and cybercrime investigation is expanding rapidly. The ability to develop software solutions to handle problems in these areas is of paramount importance in the continued success of these techniques in court proceedings. This course examines the means by which forensic tools are developed. Students will progress from basic programming, to the development of large-scale forensic solutions. As the ultimate aim of every case is its successful prosecution in a courtroom, students will see how the forensic tools are tested and validated using scientific methodologies, thus ensuring that any evidence acquired through the use of these tools will be admissible in court.

Knowledge
-After completing the course, candidates will have knowledge of:
-general programming concepts in both imperative and object-oriented paradigms
-methods of forensic tool testing and validation
-legal issues related to the admissibility of digital evidence in court proceedings both in the Nordic countries and internationally

Skills
-After completing the course, candidates will be able to:
-develop large-scale forensic applications
-compare the performance of forensic tools
-evaluate the validity of the results returned by forensic tools
-present the results of new tools in the courtroom

General competence
-After completing the course, candidates will be able to:
-perform professional tasks in the role of digital forensic investigator with increased insight and confidence
-see the role of digital forensics in a broader perspective during an investigation
-identify ethical and legal issues during investigation

-E-learning and assignments, through PHS (Politihøgskolen)

This course will be delivered on-line through a combination of lectures, exercises, quizzes and assignments.The approximate duration of the module is 280 hours. Students may choose to study at their own pace within the semester. However, it is expected that the course is completed within 4 months. Since software development is a practical skill, students will be presented with numerous exercises throughout the course to ensure that they have sufficient practical exposure. Student support will be delivered via electronic means such as: email, discussion fora, chat and virtual classrooms. An e-learning platform is used for the administration and implementation of the module (PHS Canvas/PingPong).

Compulsory assignments:
-Successful completion of up to 10 on-line MCQ tests throughout the course. Students may have multiple attempts at these tests if necessary.

The course responsible and point of contact at PHS: Fergus Thomas Toolan. PHS offers a similar course in Forensic, possible to sign in before enrollment to the master program. Students who have passed the PHS course can apply for replacement of IMT4505-PHS when enrolled to MISEB.