CSDO-8 Digital Forensics
CSDO-8 Digital Forensics
- Course description
- Course CodeCSDO-8
- Level of Study5.2
- Program of StudyCyber Security, Defence and Operations
- Credits15
- Study Plan CoordinatorJustine Moodley
When an incident has occurred, organisations need to establish what happened in a way that can be documented and, if needed, used as evidence. This course introduces the work of a forensic investigator and brings together the defensive and offensive perspectives from the previous courses.
Students learn forensic principles and the legal requirements for lawful acquisition, evidence preservation and chain of custody. They acquire and analyse evidence from disks, memory, malware, network traffic, logs, OT and cloud services, and assess the relevance and reliability of evidence, including evidence produced or analysed with AI. Through purple teaming, students test their own detections and discuss attack techniques with peers. The course also includes a crisis simulation with students from other programmes and external roles. Students assess what happened in an incident, determine what measures need to be implemented to prevent it from happening again, and explain their findings and methods in a forensic report.
The candidate:
- has knowledge of forensic principles and the methods used to acquire and analyse evidence from disks, memory, malware, networks, logs, OT and cloud services
- has knowledge of how AI is used in forensic analysis and of its limits when handling evidence
- can assess their own investigations in relation to legal requirements for lawful acquisition, evidence preservation and chain of custody
- is familiar with the work of a forensic investigator and how security roles work together in a crisis
- has insight into their own opportunities for development in cyber security, reflected on in the final project week
The candidate:
- can explain their findings and the methods they used in a forensic report
- can reflect over their own detections after testing them through purple teaming, and adjust them under guidance
- can assess the relevance and reliability of evidence, including evidence produced or analysed with AI
- can assess what happened in an incident and determine what measures need to be implemented to stop it happening again
The candidate:
- can plan and carry out a forensic investigation, from lawful acquisition to analysis, in a way that would hold up in court
- can work with students from other programmes and with external roles during a crisis simulation
- can discuss detections and attack techniques with peers through purple teaming, and contribute to better practice
- can contribute to organisational development by turning lessons from incidents and crisis simulations into better routines
Students use a combination of written content, videos and practical learning activities designed to help them achieve the course learning outcomes.
Industry Relevance
Course content, learning activities and tools reflect industry standards and are developed in collaboration with industry partners and experts from the field.
Practical Work
The course includes regular practical activities where students apply their knowledge and practise relevant skills.
Collaboration
Collaboration is facilitated through the LMS and Teams, and students are encouraged to work together for peer support and shared learning.
Guidance
Teachers are available for guidance at scheduled times. Students are encouraged to share work in progress and use feedback from teachers and fellow students to develop their work further.
This course has one coursework requirement, graded Approved / Not Approved.
| Form of assessment | Grading scale | Grouping | Duration of assessment |
|---|---|---|---|
Course Assignment | Grade A-F | Individual | 1 Week(s) |