In-depth coverage of live incident response and file system forensic analysis. The course will include the use of various tools and techniques used to extract information from digital media, with a focus on information that is difficult to find using normal methods. These tools and techniques will be supplemented with theoretical discussion, both of the structure of the media itself and of the nature and limitations of digital evidence. The course will cover the most commonly used operating systems and file systems.

Note: Open only to students in the Graduate Diploma in Information Assurance, Graduate Diploma in Information Security, Master of Information Systems Assurance Management, or Master of Information System Security Management programs.

Prerequisites: Information Systems Security Management 521
Further information: Course availability and times