Course Objectives: Upon completion of the course, students will be able to: ❖ Recognise and explain the fundamental concepts, processes, and challenges of digital forensics. ❖ Identify, acquire, and preserve digital evidence using established forensic procedures. ❖ Analyse data from filesystems, memory, networks, and applications to uncover traces of malicious activity. ❖ Apply specialised forensic tools to reconstruct timelines, attribute actions, and detect anti-forensic techniques. ❖ Evaluate the legal and ethical issues associated with digital investigations. ❖ Document and present forensic findings in a clear, structured, and professional manner suitable for legal and organisational contexts. Course Competencies: Describe the role of digital forensics within the broader field of cybersecurity. Apply proper procedures to ensure integrity and admissibility of digital evidence. Use industry-standard forensic tools (e.g., Autopsy, FTK Imager, Volatility, Wireshark) to acquire and analyse digital artefacts. Perform forensic analysis on filesystems, memory dumps, and network traffic. Reconstruct events and timelines from disparate digital sources. Detect, interpret, and counter basic anti-forensic techniques. Communicate findings effectively through technical reports and presentations. Understand the legal frameworks, ethical considerations, and professional responsibilities in digital forensics practice.