This course provides an in-depth coverage of live incident response and file system forensic analysis; including the use of various tools and techniques used to extract information from digital media, with a focus on difficult to retrieve information. Forensics tools and techniques will be supplemented with theoretical discussions, both of the structure of the media itself and of the nature and limitations of digital evidence. The course will cover the most commonly used operating systems and file systems.

Note: Open only to students in the Graduate Diploma in Information Security, or Master of Information System Security Management programs.

Prerequisites: Information Systems Security Management 523
Further information: Course availability and times