Introduction to Digital Forensics

Course Description

Introduction to Digital Forensics covers the forensic process; forensic duplication; authentication; file recovery; file systems; the FAT file system; digital artifacts; and various digital forensic tools, providing foundational knowledge in how digital evidence is collected, preserved, and analysed within the context of forensic investigations.

Within the SCNS taxonomy, CET is the Computer Engineering Technology prefix. Daytona State publishes this at 3 credits, offered spring and summer, with CIS4360 as prerequisite, giving approximately 45 contact hours at the prefix's unsuffixed convention.

Notice the order of the topics in the catalog description: process first, tools last. That ordering is deliberate and it is the discipline's central lesson. Anyone can be taught to run a forensic tool; what makes someone a forensic examiner is a defensible process — acquiring without altering, proving nothing changed, documenting continuously, and being able to explain all of it to a court years later. The tools change every few years; the process does not.

Daytona State does not publish a lecture and laboratory split for its CET courses. The prefix's unsuffixed courses run consistently at 15 contact hours per credit — CET1588, CET2544, CET2691, CET2792, CET2793, CET2794, CET3505 and CET4542 are all published at 3 credits and 45 hours, without exception. Its C-suffixed courses run at 20 or above and its L-suffixed laboratories at 30. This course is unsuffixed and is priced at the unsuffixed convention.

Learning Outcomes

Required Outcomes

• Describe the digital forensic process from identification to reporting.
• Describe the legal framework governing digital evidence.
• Describe search authority, warrants, and consent in digital investigations.
• Describe the roles of the examiner, the investigator, and counsel.
• Apply chain of custody procedures and documentation.
• Perform forensic duplication using write-blocking hardware or software.
• Describe forensic image formats and their characteristics.
• Verify image integrity using cryptographic hashing.
• Describe hash algorithms and the significance of collisions.
• Authenticate evidence and demonstrate that it has not been altered.
• Describe storage media structures, including partitions and volumes.
• Describe the FAT file system and its structures in detail.
• Describe how files are stored, deleted, and recovered.
• Recover deleted files and describe the limits of recovery.
• Perform file carving from unallocated space.
• Describe slack space and residual data.
• Identify and interpret file signatures and headers.
• Locate and interpret digital artifacts of user activity.
• Construct a timeline of activity from artifacts and metadata.
• Use forensic tools appropriately and describe their limitations.
• Validate tool output and corroborate findings independently.
• Maintain contemporaneous examination notes.
• Write a forensic report that is accurate, complete, and comprehensible.
• Describe the examiner's ethical obligations, including objectivity.

Optional Outcomes

• Describe anti-forensics techniques and their detection.
• Describe encryption and its effect on examinations.
• Describe live acquisition and volatile data capture.
• Describe cloud and remote evidence considerations.
• Describe expert witness testimony and its preparation.
• Prepare for an entry-level forensic certification.

Major Topics

Required Topics

• The digital forensic process
• Legal framework for digital evidence
• Search authority and consent
• Roles in an investigation
• Chain of custody
• Forensic duplication and write-blocking
• Image formats
• Hash verification
• Hash algorithms and collisions
• Evidence authentication
• Storage media structures
• The FAT file system
• File storage, deletion, and recovery
• Deleted file recovery
• File carving
• Slack space and residual data
• File signatures and headers
• Digital artifacts of user activity
• Timeline construction
• Forensic tools and limitations
• Tool validation and corroboration
• Examination notes
• Forensic report writing
• Examiner ethics and objectivity

Optional Topics

• Anti-forensics and its detection
• Encryption and examinations
• Live acquisition and volatile data
• Cloud and remote evidence
• Expert witness testimony
• Certification preparation

Resources & Tools

• The programme's laboratory and its isolated network — the only place you can lawfully practise most of this. Use every scheduled hour and every open-lab hour.
• Virtualisation software — VirtualBox is free, VMware Workstation Player is free for personal use; a home lab of virtual machines costs nothing but disk space.
• Kali Linux and the SANS SIFT Workstation — free tool distributions for security testing and forensics respectively.
• Autopsy and The Sleuth Kit (sleuthkit.org) — free and open-source forensic tools used professionally, not merely for teaching.
• NIST Computer Forensics Tool Testing programme (cftt.nist.gov) — free tool validation reports; the reference when you need to defend a tool choice.
• NIST Special Publications, especially SP 800-86 (forensic techniques in incident response) and SP 800-61 (incident handling) — free, authoritative, and directly examinable.
• CISA (cisa.gov) — free advisories, guidance, and free training resources.
• MITRE ATT&CK (attack.mitre.org) — free; the standard framework for describing adversary behaviour, and increasingly expected knowledge.
• TryHackMe, Hack The Box, and OverTheWire — lawful practice environments, with free tiers; the right place to practise offensive technique.
• CompTIA and Cisco Networking Academy materials — aligned to the certifications employers ask for.
• File System Forensic Analysis (Carrier) — the reference on file system internals, and the book behind The Sleuth Kit.
• Guide to Computer Forensics and Investigations (Nelson et al.) — the standard course text.
• Digital Corpora (digitalcorpora.org) — free realistic disk images and scenarios for lawful practice.
• NIST CFReDS — free reference data sets designed for testing examiner skill and tool behaviour.

Career Pathways

• Information security analyst — SOC 15-1212; consistently among the fastest-growing occupations.
• Computer network support specialist — SOC 15-1231; computer user support specialist — SOC 15-1232.
• Network and computer systems administrator — SOC 15-1244.
• Digital forensics examiner — in law enforcement, in corporate investigations, and in consulting firms.
• Incident responder and security operations centre analyst — a large and growing entry route into security.
• Electrical and electronics engineering technologist or technician — SOC 17-3023, for the digital design pathway.
• Embedded systems and FPGA development — a specialised, well-paid pathway from the digital design sequence.
• Florida's defence, space, and simulation sector — the Space Coast, Orlando's simulation and training cluster, and Tampa's defence presence all hire heavily in these areas, and many roles require U.S. citizenship and a security clearance.
• Public sector and law enforcement — state and county agencies, and federal offices with a large Florida presence.
• Healthcare, financial services, and hospitality IT — all large Florida sectors with substantial compliance-driven security demand.
• Consulting and managed security service providers.
• ⚠ Many security and forensics roles require a clean background — criminal history, and for cleared work significant unresolved debt or foreign contacts, can be disqualifying. Find this out before investing in the pathway.

Special Information

⚠⚠ Understand the file system, not just the tool

• A forensic tool that presents a recovered file is making a claim about file system structures, and you must be able to explain and defend that claim. "The software found it" is not testimony.
• Deleting a file usually does not remove the data. It marks the space available — which is why recovery works, and why the window for recovery closes as the space is reused.
• FAT is taught first because it is simple enough to understand completely, and understanding one file system completely is what lets you reason about NTFS, EXT, and HFS+ later.
• Slack space holds residual data from previous files, and it is frequently where the significant fragment is found.
• File carving ignores the file system entirely and reconstructs files from signatures in raw data — essential when metadata is destroyed, and it produces false positives you must evaluate.
• Metadata timestamps have specific meanings that differ by file system and are altered by ordinary activity. Do not build a timeline on timestamps you have not verified.
• Corroborate every significant finding from a second artifact or a second tool. A conclusion resting on one tool's interpretation is fragile.
• Know what your tool does not show you. Every tool has blind spots, and NIST's tool testing reports document many of them.

⚠⚠ Chain of custody and admissibility — evidence you cannot defend is evidence you do not have

• The technical work is only half of digital forensics; the other half is being able to prove, later and under challenge, that what you produced is what was there. An analysis that cannot be defended in a hearing is an analysis that did not happen.
• Never work on the original. Acquire a forensic image using a hardware or software write-blocker, verify it, and work only from copies.
• Hash everything, before and after. A cryptographic hash of the source and of the image, recorded at acquisition and re-verified afterwards, is what demonstrates the data has not changed. Record the algorithm and the values in your notes, not just in the tool's log.
• Document chain of custody continuously — who had the evidence, when, where it was stored, and every transfer, signed. A single unexplained gap can exclude the evidence entirely.
• Contemporaneous notes are the deliverable. What you did, when, with which tool and version, and why. You may testify years later, and you will have only what you wrote.
• Your process must be reproducible by another examiner reaching the same result — that is what makes it a method rather than an opinion.
• Validate your tools and know their limitations; "the software said so" is not a finding you can defend.
• Report what you found, including what does not support the theory you were asked about. An examiner who reports selectively is not an expert witness, and it will be exposed.
• Stay within your competence. Testifying beyond what you can actually support is how examiners are discredited.
• ⚠ Standards for expert testimony have changed in Florida in recent years, and the admissibility of technical evidence is a live legal question. Rule 11 applies — work with counsel and verify the current standard rather than relying on this guide.

⚠⚠ Authorisation is the line between a security professional and a defendant

• Never access, scan, or test a system you do not have written permission to touch. Not a friend's network, not your employer's without authority, not a "harmless" port scan of a site you use. This is the one rule in this field that carries criminal consequences.
• Federal exposure: the Computer Fraud and Abuse Act criminalises unauthorised access to a protected computer, and "exceeding authorised access" has been read broadly.
• ⚠⚠ Florida exposure is separate and additional: the Florida Computer Crimes Act, Chapter 815, Florida Statutes, makes offences against intellectual property, computer users, and computer equipment punishable under state law independently of federal law. A student who assumes only federal law applies is wrong.
• Curiosity is not a defence, and neither is intent to help. Discovering a vulnerability and testing it without authorisation is an offence even when you meant to report it.
• Use the lab. Your programme provides an isolated environment precisely so you can practise techniques that would be unlawful elsewhere — build your own isolated lab at home too, and keep it off the production network.
• Get scope in writing before any authorised engagement — systems, addresses, times, techniques permitted, and who to contact when something breaks. A verbal "go ahead" protects nobody.
• Stay inside scope once you start. Following an interesting path onto a system not covered by the authorisation is where legitimate testers get into trouble.
• Responsible disclosure has a process. Follow the vendor's or organisation's published route, and do not publish details before it has been addressed.
• ⚠ Rule 11 applies. Computer crime, privacy, and disclosure law changes; verify current law and take advice rather than relying on a course guide.

⚠ Certifications carry real weight in this field — more than in most

• Information technology and security hire on demonstrated capability, and certifications are the common shorthand for it — frequently appearing as hard requirements in job postings and in government and contractor roles.
• Foundational: CompTIA A+ (hardware and operating systems), Network+, and Security+. Security+ in particular satisfies a widely cited U.S. Department of Defense baseline requirement, which makes it valuable in Florida's substantial defence and contractor sector.
• Networking: Cisco CCNA remains the recognised entry credential.
• Digital forensics: EnCE (EnCase), ACE (AccessData), CCE, and the SANS GCFE and GCFA. The SANS credentials are the most respected and by far the most expensive — employers frequently pay for them, so raise it at interview rather than self-funding.
• Security management: CISSP is the senior standard but requires several years of documented experience; SSCP is its practitioner-level counterpart and is reachable earlier.
• Time your certification to your coursework. Sit the examination while the material is fresh — pass rates fall sharply the longer graduates wait.
• Certifications expire. Most require continuing education and renewal, so plan for the ongoing cost.
• ⚠ A certification is not a substitute for the degree, and the degree is not a substitute for certifications. Employers in this field commonly want both, plus evidence you have actually built and broken things.
• Build a home lab and document it. Virtual machines cost nothing, and a candidate who can describe what they built and what went wrong interviews far better than one who lists courses.

How Florida course levels affect transfer

The first digit of an SCNS number denotes the year of offering, not transferability. Courses at the 1000 and 2000 levels transfer transparently between Florida public institutions, and 3000 to 4000 is unproblematic since both are upper division. The boundary that actually matters is 2000 to 3000, where lower-division credit generally cannot satisfy an upper-division requirement.

⚠ That boundary is live in this prefix. Daytona State offers CET courses at the 1000, 2000, 3000 and 4000 levels, the upper-division ones forming part of a bachelor of applied science. A 2000-level CET course does not substitute for its 3000- or 4000-level counterpart even where the subject matter overlaps — compare CET2880C/CET2881C (Data Forensics I and II, lower division) with CET4860/CET4861 (Introduction to and Advanced Digital Forensics, upper division). Confirm with an advisor which lower-division courses feed the BAS.

CET4860 is 3 credits and approximately 45 contact hours, offered spring and summer at Daytona State, prerequisite CIS4360.

It is the first of an upper-division forensics sequence — CET4860 → CET4861, with CET4862 covering network forensics. ⚠ Do not assume the lower-division CET2880C/CET2881C (Data Forensics I and II) substitute for these; they are separate courses at a different level.