CNIT 121: Computer Forensics

Fall 2024 Sam Bowne

Tue 6-9 pm SCIE 37 CRN: 72080

Schedule · Projects

This class has physical meetings but physical attendance is not required. To attend class online:
https://twitch.tv/sambowne

Free Textbook Access

  • Go here
  • Click "Institution not listed"
  • Enter your CCSF email address
  • Enter the book's title the "Find a Solution..." field

Quizzes

The quizzes are multiple-choice, online, and open-book. However, you may not ask other people to help you during the quizzes. You will need to study the textbook chapter before the lecture covering it, and take the quiz before that class. Each quiz is due 30 min. before class. Each quiz has 5 questions, you have ten minutes to take it, and you can make two attempts. If you take the quiz twice, the higher score counts.

Don't use CCSF's Canvas system for this class. Instead, all students should use this Canvas server:

Enroll Here · View Course · Reset password

Email

For class-related questions, please send messages inside Canvas, or email cnit.121@gmail.com


Schedule


Tue 8-20  Mod 1: The Scope of Digital Forensics
Demo: Binary Games


Tue 8-27Mod 1 Quiz *
Mod 2 Quiz *
Proj H 101 - H 104 due *
Mod 2: Windows Operating and File Systems
Demo: F 200


Tue 9-3Mod 3 Quiz
Proj F 60 & F 200 due
Mod 3: Handling Computer Hardware
Demos: F 201 and F 202


Fri 9-6 Last Day to Add

Tue 9-10Mod 4 Quiz
Autopsy Videos 0-2 due
Mod 4: Acquiring Evidence in a Computer Forensics Lab
Demo: F210


Tue 9-17No Quiz
No Proj due
Guest Speaker: From aspiration to achievement:
Lexie Thach's Journey into cybersecurity.
Defensive Cyber Operations Engineer at
the Naval Information Warfare Center


Tue 9-24Mod 5 Quiz
Autopsy Videos 3-4 due
Mod 5: Online Investigations
Demo: F220


Tue 10-1Mod 6 Quiz
Proj F 201 & F 202 due
Mod 6: Documenting the Investigation
Demo: F221


Tue 10-8Mod 7 Quiz
Proj F 210 due
Mod 7: Admissibility of Digital Evidence
Demo: F230


Tue 10-15Holiday: No Class

Tue 10-22Mod 8 Quiz
Proj F 220 due
CLASS ONLINE ONLY
Mod 8: Network Forensics and Incident Response
Demo: H 420


Tue 10-29No Quiz
No Proj due
Lockpicking: Extra Credit


Tue 11-5No Quiz
No Proj due
King of the Hill competition (no lecture)

Tue 11-12Mod 9 Quiz
Proj M 144 due
Mod 9: Mobile Forensics
Demo: M 144


Tue 11-19No Quiz
Proj F 230 due
Mod 10: Mobile App Investigations


Tue 11-26Mod 10+11 Quiz
Proj H 420 due
Mod 11: Mac Forensics


Tue 12-3 Velociraptor Demos: IR 100, IR 371, IR 372, IR 373, IR 374


Tue 12-10All Extra Credit Due Last Class: No new material


Fri 12-13
through
Fri 12-20
  Final Exam available online throughout the week.
You can only take it once.

All quizzes due 30 min. before class
* No late penalty until 9-10

Projects

Grading Policy

Autopsy User Documentation

Submitting Projects

CCSF students must do these things to get credit:

  • Perform the project steps until you find a flag
  • Capture a whole-desktop image showing the flag
  • Outline or highlight the flag in the image
  • Submit the image in the appropriate Project in Canvas
  • Type the flag into the text field

Setup

H 101-4: Binary Games (20 pts.)

Download VMware from Uptodown

Do At Least One of these Three Projects

F 60: Cloud Server on Azure (15 pts)
F 61: Windows Server on Google Cloud (15 pts extra)
ED 32: Windows 10 Virtual Machine (15 pts extra)

Using Autopsy

F 200: Examining a Forensic Image with Autopsy (15 pts.)
F 201: Rhino Hunt with Autopsy (15 pts + 10 extra)
F 202: Rhino Hunt with Wireshark (15 pts + 15 extra)
F 210: Memory Analysis with Autopsy (15 pts + 30 extra)
F 220: Capturing and Examining the Registry (15 pts)
F 221: Examining a Windows Disk Image (25 pts extra)

M 140: Android Studio Emulator (15 pts extra)
M 142: Rooting Android Studio's Emulator (15 pts extra)
M 143: Forensic Acquisition from Android (15 pts extra)
M 144: Android Analysis with Autopsy (10 pts)
M 145: Making a Rooted Android Emulator (10 pts extra)

Project F 211 Removed

F 230: iPhone Analysis with Autopsy (20 pts)

Other Tools

H 420: Wireshark (25 pts + 85 extra)

IR 100: Windows and Linux Machines (20 pts extra)
IR 371: Velociraptor Server on Linux (25 pts extra)
IR 372: Investigating a PUP with Velociraptor (40 pts extra)
IR 373: Investigating a Bot with Velociraptor (50 pts extra)
IR 374: Investigating a Two-Stage RAT with Velociraptor (35 pts extra)

If you use the scoreboard, don't submit
those projects in Canvas.

Enter Flags · Scoreboard · Scoreboard (Alphabetical) · Details

Updated: 12-18-24 11:30 am