Forensic Investigation (Digital Forensics and Cybersecurity Option)

The Canadian criminal justice system is an adversarial system which pits the accused person against the State. The adversarial process follows a well-defined series of procedural steps from initial complaint to verdict and sentencing. This course provides a detailed examination of the legal procedures that govern criminal proceedings in Canada including the tendering of evidence by both Crown and defence, with a particular emphasis on issues applicable to forensic investigators and technicians.
Prerequisite(s):

• Admission to a Forensic credential program or permission of the Program Coordinator.

Forensic evidence is subject to all the general rules related to the admissibility of evidence in the criminal trial process and is also subject to certain unique rules of scrutiny. This course examines the fundamental laws of evidence within the adversarial process and provides a context for the expert in their role as witness.
Prerequisite(s):

• 60% in FSCT 7001

The course provides an introduction and an overview on planning and implementation of contingencies in case of a disaster. The course intends to familiarize students with technology focused on the business aspects related to disaster recovery planning and management.
Prerequisite(s):

• Admission to a Forensic credential program or permission of the Program Coordinator.

This course introduces students to the scientific principles of digital forensics and provides a good forensic evidence acquisition experience with the most common digital devices found today. Students will learn the fundamental components of a forensic investigation, including proper evidence collection, the chain of custody, and forensic standards for legal evidence. Students will understand how to forensically acquire laptop/desktop computers, mobile phones, Raid arrays and USB drives, as each device type often requires a unique combination of skills, techniques and forensic tools to capture a forensic image that can be used for evidentiary purposes. The course offers a brief introduction to data recovery methods and techniques, which would assist the future investigator in extracting data from non-functioning digital devices.
Prerequisite(s):

• Admission to a Forensic credential program or permission of the Program Coordinator.

This course is an introduction to cybersecurity, with an emphasis on the fundamental skills needed to design and maintain secure systems. Topics will include access control, logging and monitoring, and hardening systems. The course will also cover the foundations of network communication, and students will be taught the basic scripting skills required to automate key cybersecurity tasks. Through lectures and hands-on labs in a Linux environment, student will learn the foundational skills required to move on to advanced courses in Network Security and Administration. This course is an introduction to cybersecurity, with an emphasis on the fundamental skills needed to design and maintain secure systems. Topics will include access control, logging and monitoring, and hardening systems. The course will also cover the foundations of network communication, and students will be taught the basic scripting skills required to automate key cybersecurity tasks. Through lectures and hands-on labs in a Linux environment, student will learn the foundational skills required to move on to advanced courses in Network Security and Administration.
Prerequisite(s):

• Admission to a Forensic credential program or permission of the Program Coordinator.

​This course introduces students to the concepts of cloud computing, forensics and security. The course will touch on advanced cloud concepts, including security and privacy, and discuss the best methods to store, control, manage and access private and corporate data in the cloud while addressing issues such as risk management and disaster recovery. The course will discuss the modern cloud forensics approaches and challenges with preserving, collecting and processing cloud-based data and the best methods and tools to commence a forensics investigation in the cloud.​
Prerequisite(s):

• No prerequisites are required for this course.

This course will introduce students to forensic issues related to mobile devices that may use cloud resources. Students will learn what data can be retrieved from a mobile device, and they will get hands-on experience using current tools to perform the extraction. Students will analyze this data and align it with records from network security providers to inform an investigation. Cloud resources will also be addressed using industry standard software. Technical and legal issues will be considered.
Prerequisite(s):

• Admission to a forensic credential program or permission of the Program Head

Students will learn how to identify, collect, and preserve digital evidence with an emphasis on evidence collected from the Windows operating system. Topics include fundamental computer forensics principles, information extraction, legal issues, and challenges posed by variations in both data sources and devices. Students will use specialized forensic software to collect and use evidence in a forensically sound manner, to support an investigation. ​
Prerequisite(s):

• 60% in FSCT 7509

Students will learn advanced concepts in digital forensic analysis and investigation. The course will cover the investigation and response process from the focus of a computer forensics analyst. Topics include analysis of evidence from computers, networks, and mobile devices; event reconstruction; interpretation of digit evidence; and anti-forensic techniques, including encryption, steganography and rootkit hiding. Throughout this course, extensive hands-on exercises provide the students with practical experience in performing computer forensic investigation in the real world.
Prerequisite(s):

• 60% in FSCT 8513

This course is an introduction to the fundamentals of network administration, with particular emphasis on network security monitoring. Students will learn fundamental concept related to the design of secure networks, including the deployment of security devices and sensors. Students will get hands-on experience in network traffic analysis, using packet sniffers and other network monitoring tools. Intrusion detection, attacks and defenses will be introduced to prepare students for more advanced courses in network security administration.
Prerequisite(s):

• 60% in FSCT 7511

This course covers advanced topics in network security and intrusion detection. In-depth coverage of perimeter protection and firewall designs. Advanced Intrusion Detection and IDS/IPS design and implementation. Students will be familiarized with network monitoring and security tools, and use them to perform traffic and IDS signature analysis, and network forensics. Also covered will be reverse engineering and machine code analysis techniques. These will be used to analyze malicious code and malware.
Prerequisite(s):

• 60% in FSCT 8540

This course is a study of prototyping security tools using high-level languages such as Ruby, Python, and Lua. Implementation of basic communication applications using the TCP/IP protocol suite will be introduced. Security applications that will be designed and implemented as part of the course will include packet sniffers, backdoors, logfile parsers, packet crafters, variety of spoofing applications, simple Intrusion Detection and Prevention systems. Also covered will be shell scripting techniques and implementation of shell-scripts to perform system-related tasks. As part of implementing defensive applications, students will also be introduced to basic Linux-based tools and utilities such as Netfilter, cron, etc.
Prerequisite(s):

• 60% in FSCT 7511

This course teaches students the art and science of securing data in the presence of an adversary, namely cryptography. The course begins with the mathematical foundations of cryptography, including pseudo-random number generation, and hence proceeds with a coverage of secret key algorithms and public key algorithms. The students learn the principles of operation of such cryptographic techniques, along with representative algorithms from both fields. The students also learn attack techniques that apply to secret key algorithms and public key algorithms. The course teaches students the design and use of stream ciphers as well. The students learn various schemes to securely manage and exchange cryptographic keys. The students also learn applications of one-way functions to compute and verify hashes and digital signatures. The course also teaches students the principal identification schemes currently in use. Throughout the course, the students also learn the use of various cryptographic tools.
Prerequisite(s):

• 60% in FSCT 7511

The course covers a wide range of topics from common vulnerabilities and tools that are used to exploit, to incident response and handling. Addresses theoretical and practical issues in malicious programs and scripts, stegonagraphy, worms and different types of network exploits and attacks.
Prerequisite(s):

• 60% in FSCT 8540

This course will cover emerging, specialized areas in Digital Forensics and Cybersecurity. The goal is to introduce new vulnerabilities, investigative techniques, and technologies. Students will be expected to develop new competency and knowledge in specialized areas, and they will also be expected to research and present topics of contemporary interest in Digital Forensics and Cyber security. Instructors will be drawn from a range of high tech companies, government organizations, and law enforcement communities.
Prerequisite(s):

• 60% in FSCT 7509 and 60% in FSCT 7511