DIGITAL FORENSICS - 2025/6

Module Overview

The module teaches digital forensics models and techniques used by analysts and law enforcement officers in practice. It also teaches the theory and application of real-world digital forensics tools and puts an emphasis on data recovery and the analysis of multimedia artifacts. Relationships and links between multimedia security, digital forensics and broader cyber security topics are also covered.

Module provider

Computer Science and Electronic Eng

Module Leader

RADOMIROVIC Sasa (CS & EE)

Number of Credits: 15

ECTS Credits: 7.5

Framework: FHEQ Level 7

Module cap (Maximum number of students): N/A

Module Availability

Semester 1

Prerequisites / Co-requisites

None

Module content

• 
  Definitions and conceptual model, legal concerns
  


• 
  Standards and best practices in digital forensics, ACPO good practice guide for digital evidence, digital forensics process
  


• 
  Storage forensics, data acquisition, filesystem analysis, data recovery and file carving
  


• 
  Multimedia forensics
  


• 
  Selected sub-areas of digital forensics, e.g., live forensics, memory forensics, network forensics, mobile forensics, operating system forensics, ...
  


• 
  Digital forensics tools, artefact analysis, timeline analysis, forensic soundness
  


• 
  Counter-forensics, encryption, steganography, data wiping
  


• 
  Forensic report writing and expert testimony
  

Assessment pattern

Alternative Assessment

n/a

Assessment Strategy

The assessment strategy is designed to provide students with the opportunity to demonstrate that they have achieved the module’s learning outcomes.

 

The summative assessment for this module consists of:

• 
  An individual coursework testing students’ practical skills of applying one or more selected digital forensics tools and algorithms to conduct a number of analytical tasks. This addresses mainly the first three learning outcomes (LO3, LO4 & LO5) in a practical setting.
  


• 
  An individual coursework testing students’ understanding of key concepts of digital forensics and their capability of keeping contemporaneous notes of a forensic investigation and writing a digital forensic report. This addresses mainly the last three learning outcomes (LO1, LO2) in a practical setting.
  
   
  

Formative assessment and feedback

Technologies and concepts taught in lectures are demonstrated in lab sessions to the students and practiced by the students themselves by solving exercises with appropriate software tools. Sample solutions to all lab exercises will be provided after each lab session. Some lab sessions will be dedicated to provide support for the assessments.  Office hours are used to provide additional individual support as needed.

Module aims

• The aim of this module is to equip students with background knowledge and practical experience of modern digital forensics techniques. The module will explain the underlying theory and concepts, as well as provide students with hands-on experiences with real-world digital forensics tools.

Learning outcomes

Methods of Teaching / Learning

The learning and teaching strategy is designed to:

• 
  Introduce concepts with real-world examples
  


• 
  Drive students’ interests by engaging them with hands-on exercises
  


• 
  Consolidate students’ learning on cryptography and security by applying them to new problems
   
  

The learning and teaching methods include:

• 
  Lectures to introduce concepts and theory to students combined with real-world examples.
  


• Lab sessions to expose students to hands-on exercises on programming and using digital forensics software tools to consolidate what they learned in lectures and assist their coursework.

Students will be expected to distribute the remaining workload on guided self-study, preparation for lectures and labs, and submission of the coursework.

Indicated Lecture Hours (which may also include seminars, tutorials, workshops and other contact time) are approximate and may include in-class tests where one or more of these are an assessment on the module. In-class tests are scheduled/organised separately to taught content and will be published on to student personal timetables, where they apply to taken modules, as soon as they are finalised by central administration. This will usually be after the initial publication of the teaching timetable for the relevant semester.

Reading list

https://readinglists.surrey.ac.uk
Upon accessing the reading list, please search for the module using the module code: COMM069

Other information

Digital Capabilities
Forensic analysis of computer systems is an area that has rapidly grown in importance over the last decade. This module provides a grounding in this area with practical skills in steganography and watermarking techniques. Students will gain a practical working knowledge of Matlab (an industry standard tool) along with an understanding of the important algorithms in digital multimedia security.

Employability
This module provides both practical skills in developing secure multimedia systems and the fundamental underlying knowledge in basic multimedia security algorithms. The practical skills in Matlab are highly valued in industry both within this area and in other areas. These skills are highly valuable to employers and provide a specialism that will allow a student to confidently work in digital forensics and multimedia security. 

Global and Cultural Skills
Computer Science is a global language and the tools and languages used on this module can be used internationally. This module allows students to develop skills that will allow them to reason about and develop applications with global reach and collaborate with their peers around the world. The problems address on this course and algorithms and techniques taught in this course area applicable worldwide.

Resourcefulness and Resilience
This module involves practical problem-solving skills that teach a student how to reason about securing in complex systems that deal with multimedia. Digital forensics is an area where the ability to adapt to solve problems in different settings is crucial and the knowledge gained on this course along with the assessment is presented with a view to addressing the problem solving nature of this area. 

Programmes this module appears in

Please note that the information detailed within this record is accurate at the time of publishing and may be subject to change. This record contains information for the most up to date version of the programme / module for the 2025/6 academic year.