MSc Computer Forensics and E-Discovery. Investigating Technology Crimes & Security Breaches

MSc Computer Forensics

and E-Discovery

Investigating Technology Crimes & Security Breaches

Electronic evidence has become almost

as important as DNA evidence

The New York Times, 2008

Millions of mobiles are lost and discarded every

year, yet their owners give little thought to the

sensitive data they contain

The Guardian, 2008

In the future, security professionals must stay on top of the latest

technologies and best practices through continuing education and practical experience to deal with the evolving computing environment.

Frost & Sullivan and (ISC)2, 2008

Spending on electronic

discovery (e-discovery)

software technologies and

services offerings is forecast

to grow at more than 35%

annually through 2011.

Gartner Inc., 2007

This is an emerging market

with entrants from multiple

perspectives, including

storage and archiving,

search and information

access, policy management,

and tools designed as

end-user applications for legal

professionals.

Gartner Inc., 2007

BLS (Bureau of Labor Statistics) rates the future opportunities for qualified computer forensic investigators as ‘excellent’.

The Futurist, 2008

Ebay camera contains ‘secret’

MI6 terrorist images

The Guardian, 2008

Computer Forensic

Expert listed in the top

10 Hot Jobs for 2007

AOL Jobs, 2007

Computer Forensics investigation lead to the discovery of the body in the Chandra Levy murder case.

CNN, July 2001

The new breed of gumshoe is trained to study bytes the way old-school G-men studied fingerprints.

Popular Mechanics, May 2006

Computer forensic

examiners need to

combine art and science

to produce the highest

valued electronic data

content.

Kaplan, Journal of Digital Forensic Practice, 2008

Equally problematic, a significant percentage of these professionals lack awareness of the e-discovery guidelines for the preservation of these electronic records, exposing their organizations to even greater risk. Surety, LLC, 2008

A survey

“indicat(es) that

e-discovery as a

contentious issue

is spreading to

organizations of

all sizes.”

Fulbright & Jaworski Fourth Annual Litigation Trends Survey Findings, 2007

The (Australian) Federal Court is undergoing a massive technology overhaul as part of its eCourt strategy. This involves introducing automated case tracking, electronic lodgement, filing and document management systems, video conferencing facilities, secure court search tools and even electronic courtrooms for hearings in remote locations.

AustrialianIT, 2007

The results of the 2008 Email Security and Authentication Survey overwhelmingly indicate that IT security and compliance professionals struggle with the ability to tamperproof email records and doubt their organization’s ability to authenticate email records to ensure their admissibility as evidence during legal, regulatory and patent proceedings.

Surety, LLC, 2008

Computer Forensics investigation of a floppy disk and associated metadata lead to the conviction of the BTK Strangler (An American serial killer with crimes that occurred over a duration of sixteen years).

The New York Times, March 2005

Courts are

requiring

enterprises to

improve their

handling of

information

during litigation

More than one-third

of corporate counsel(s)

expect pace of new

filings to increase in

coming year – 43%

of billion-dollar

companies forecasting

possible litigation

uptick amid economic

slowdown.

Gartner Inc., 2007

The Past, Present and Future of Computer Forensics and E-Discovery Interaction Past Cases

Present Environment

Sophisticated criminals put a globally networked

society at risk through increasingly inventive

computer crimes. The increasing impact of these

crimes highlights the need for highly skilled

computer forensic analysts. The MSc programme

at the Humanities Advanced Technology and

Information Institute (HATII) in

Computer

Forensics and E-Discovery

confronts this

problem through a unique blend of computer and

legal expertise. This MSc environment is a fusion

of taught courses, group projects, and stimulating

research opportunities. This environment provides

the computer forensic analyst with the specialized

skills and knowledge necessary to analyse data in

context, while adhering to the highest professional

and ethical standards. In order to support

individual learning opportunities, tracks are offered

on a full-time, part-time or Continuing Professional

Development (CPD) basis.

10 core requirements (180 Credits) consisting of 4 core classes, 3 technical classes, 1 research-focused class, 1 industry and research-research-focused seminar, and 1 dissertation.

Acquire hands on experience working with advanced techniques, industry standard forensic applications and hardware in a lab environment via 4 lab based courses.

Work with world class researchers in one of world’s top 100 universities.

Programme routes offered on a full-time (completion in 1 year), part-time and Continuing Professional Development (CPD) basis.

Interact with computer forensics and security professionals, investigators, and lawyers. MSc Programme Executive Summary

Content & Core Classes

The programme is a mix of taught courses, lab work, group projects and dissertation work. This mix not only exposes students to the theoretical component of the course but provides the necessary practical exposure to current computer forensic tools and industry practices.

The core classes for the programme include:

› Introduction to Computer Forensics and E-Discovery › Legal and Regulatory Frameworks

› Computer Forensics Process and Investigative Techniques › Managing and Presenting Digital Evidence

› Systems and Networks › Introduction to Security › Security & Cryptography › Advanced Research Readings

› Research Methods and Professional Studies Seminars

Core Course Objectives

› Knowledge transfer of essential technical skills to investigate a variety of computer forensic problems and issues.

› Hands-on experience with a variety of industry grade computer forensics software and hardware tools in a dedicated lab.

› Experience in current forensic practices, processes, and procedures.

› Investigation of new approaches and processes while questioning the validity and the dependability of existing solutions.

› Contribution to the cultivation of research within the fields of Computer Forensics and E-Discovery. › Empowerment of students to conduct further autonomous academic research and/or industry

practitioner research.

Programme Paths

The Computer Forensics and E-Discovery programme targets individuals who aspire to enter the fields of: › Corporate Security Teams

› Governmental Agencies › Police and Law Enforcement › The Legal Profession

› Information Security Professions › Forensic and/or Security Consultancy

The programme also provides an opportunity for practicing professionals in the computing forensic and e-discovery arena to acquire a higher academic degree to improve career opportunities. To support individual needs and goals students are accepted on the following basis:

› Full-time › Part-time

› Continuing Professional Development (CPD)

Entry Requirements

2.1 Honours degree, or the equivalent from a recognised institution, or relative work experience. Preference will be given to students with a degree in Computing Science, Information Science, Law or similar degree.

Humanities Advanced Technology and Information Institute (HATII)

HATII is one of the world’s leading centres for computing and information studies in the arts and humanities. The Institute offers a pioneering joint honors undergraduate degree in Arts and Media Informatics as well as innovative Masters Degrees in Information Management and Preservation and Computer Forensics and e-Discovery. HATII takes an interdisciplinary and international approach to its research and has particular strengths in theoretical approaches to information and management coupled with a practical approach to the forensic retrieval of digital information.

HATII has the highest percentage of 4* World-leading research in Scotland and the joint 4th _{highest in the}

UK in the field of Library and Information Management according to the 2008 UK Research Assessment Exercise. Since 2000 HATII has attracted over £3 million of research income from the AHRC, JISC, the European Commission as well as a number of private foundations. With an active doctoral programme and range of disciplinary perspectives HATII is uniquely placed to explore the theoretical and intellectual foundations of information and its impact on society.

University of Glasgow

The University of Glasgow is the fourth oldest university in the English-speaking world. Founded in 1451, it has spent the last half millennium earning an international reputation for research innovation, making connections with experts in global business, and inspiring thinkers from eminent scientist Lord Kelvin to the father of economics Adam Smith. Building on such vast experience, it’s no surprise that Glasgow is in the top 100 of the world’s universities today (Times Higher Education Supplement World Rankings).

LNZS

|

The introduction course provides students with the foundational knowledge necessary to enable them to start to conduct computer forensic investigations.

LNXS

|

Technical ability is not enough. Computer forensic professionals need to know their way around the legal and regulatory framework.

MRSS

|

This course endeavours to understand basic security concepts. In order to accomplish this goal, an understanding of the areas is necessary, in which security and cryptography are important in developing secure software and secure distributed applications.

LNWS

|

This course provides the student with knowledge of the processes and techniques of a forensic investigation to enable them to lead a forensic team and liaise between computer engineers, clients and the legal profession.

LNWS

|

Managing and Presenting Digital Evidence gives the student the general and specific forensic project management and courtroom skills to impart the ability to manage the complete forensic investigatory process from seizure to reporting.

LEHS

|

The Systems and Networks module introduces the main levels of abstractions in a computer system. These include the underlying hardware and digital circuits; the instruction set architecture; the operating system and its interaction with the architecture; and computer networks. The focus of the module is on fundamental concepts and how they work.

JMWS

|

The aim for the course is to understand areas in which security and cryptography are important. This includes developing an understanding of a number of standard protocols used to solve security problems, to be able to evaluate their effectiveness in various situations and to be able to make sensible choices among them.

LESS

|

This course endeavours to immerse students in research topics in computer forensics and related areas.

LNUS

|

The Research Methods and Professional Studies Seminars expose students to a wide range of researchers and research topics, in this and allied fields, in an effort to expand their awareness of both theoretical and practical issues.

Additional HATII Programmes

› PhD Program

› MSc in Information Management & Preservation › Multiple UK and EU funded research projects › Contributes to the MSc in Information Technology in the

Department of Computing Science

Application Information

International & Postgraduate Admissions Office Student Services

Fraser Building University of Glasgow

65 Hillhead Street, Glasgow G12 8QQ phone +44 (0) 141 330 4515 fax +44 (0) 141 330 4045 e-mail: [email protected]

Contact Information

For additional course information contact the Department: [email protected]

MSc Administrator phone +44 (0)141 330 5165 fax +44 (0)141 330 3788

Dr. Brad Glisson

Director of the Computer Forensics and E-Discovery Programme Humanities Advanced Technology and Information Institute George Service House

11 University of Glasgow Glasgow G12 8QQ phone +44 (0)141 330 8591

www.hatii.arts.gla.ac.uk/CFED/index.htm

The University of Glasgow