Introduction to Computer Forensics

I.     Course Prefix/Number: CNS 174

       Course Name: Introduction to Computer Forensics

       Credits: 3 (3 lecture; 1 lab)

II.    Prerequisite

Recommend: CNS 111 or consent of instructor, coordinator or program chair

III.   Course (Catalog) Description

This course provides students with the knowledge and solid foundation by introducing Computer Forensics as an entry into the professional field of Computer Forensics and investigation.  The course covers current and past Operating Systems and a range of computer hardware and forensics software tools.  The course also assists students in preparing for the appropriate Network or Information Security Certification examinations.  Recommend: CNS 111 or consent of instructor, coordinator or program chair

IV.   Learning Objectives

Upon completion of this course the student will be able to;

  1. Describe the Computer Forensics, Enforcement agency investigations, corporate investigations and investigations as a Profession
  2. Learn and demonstrate how to manage a Computer Investigation
  3. Describe and explain how to use popular Computer-Forensics software
  4. Plan and list how to recover data for computer investigations and demonstrate an understanding of file systems and their associated Operating Systems
  5. Learn and list requirements for Forensic Lab Certification
  6. Understand and select a basic Forensic workstation
  7. Create a Forensic Boot Floppy Disk
  8. Identify and test Command-line Forensics Tools
  9. Explore and analyze graphical users interface (GUI) Forensics tools
  10. Identify and secure digital evidence at an incident scene and store digital evidence
  11. Process and test private-sector incident scenes
  12. Plan and list data recovery contingencies
  13. Understand and test Computer Forensics-analysis
  14. Investigate and list e-mail crimes and violations
  15. Identify and analyze copyright issues with graphics
  16. Identify and Create and test data compression
  17. Describe  and list the importance of reports, procedural and evidence rules requirements

V.    Academic Integrity and Student Conduct

Students and employees at Oakton Community College are required to demonstrate academic integrity and follow Oakton's Code of Academic Conduct. This code prohibits:

• cheating,
• plagiarism (turning in work not written by you, or lacking proper citation),
• falsification and fabrication (lying or distorting the truth),
• helping others to cheat,
• unauthorized changes on official documents,
• pretending to be someone else or having someone else pretend to be you,
• making or accepting bribes, special favors, or threats, and
• any other behavior that violates academic integrity.

There are serious consequences to violations of the academic integrity policy. Oakton's policies and procedures provide students a fair hearing if a complaint is made against you. If you are found to have violated the policy, the minimum penalty is failure on the assignment and, a disciplinary record will be established and kept on file in the office of the Vice President for Student Affairs for a period of 3 years.

Please review the Code of Academic Conduct and the Code of Student Conduct, both located online at
www.oakton.edu/studentlife/student-handbook.pdf

VI.   Sequence of Topics

  1. Computer Forensics and Investigations as a Profession
  2. Understanding Computer Investigations
  3. Working with Windows and DOS Systems
  4. Macintosh and Linux Boot Processes and Disk Structures
  5. The Investigator’s Office and Laboratory
  6. Current Computer Forensics Tools
  7. Digital Evidence Controls
  8. Processing Crime and Incident Scenes
  9. Data Acquisition
  10. Computer Forensic Analysis
  11. E-mail Investigations
  12. Recovering Image Files
  13. Writing Investigation Reports
  14. Becoming as Expert Witness

VII.  Methods of Instruction

Methods include lectures, class exercises and class discussion, perform lab exercise and projects.
Course may be taught as face-to-face, hybrid or online course.

VIII. Course Practices Required

  • Read course materials - textbook and current journals
  • Attend and participate in class lecture and lab
  • Complete required assignments, exercises, quizzes, and exams

IX.   Instructional Materials

Note: Current textbook information for each course and section is available on Oakton's Schedule of Classes.

  • Current Computer Forensics Textbook and Lab book
  • Current Self-Test Software
  • Software manuals

X.    Methods of Evaluating Student Progress

Quizzes, examinations, completion of lab assignments, exercises, and LAN project

XI.   Other Course Information



If you have a documented learning, psychological, or physical disability you may be entitled to reasonable academic accommodations or services. To request accommodations or services, contact the Access and Disability Resource Center at the Des Plaines or Skokie campus. All students are expected to fulfill essential course requirements. The College will not waive any essential skill or requirement of a course or degree program.

Oakton Community College is committed to maintaining a campus environment emphasizing the dignity and worth of all members of the community, and complies with all federal and state Title IX requirements.

Resources and support for
  • pregnancy-related and parenting accommodations; and
  • victims of sexual misconduct
can be found at www.oakton.edu/title9/.

Resources and support for LGBTQ+ students can be found at www.oakton.edu/lgbtq.