Subject: Computer Forensics
1. Topic-
Computer Hardware, Software and Operating Systems
2. Content-
Investigating High Tech Crime, Chapters One and Two.
3. Goals: Aims/Outcomes-
1.Unit 1 is intended to familiarize the students with basic data structures, types of computer hardware and software, the structure and functions of the Internet, and how data is routed.
2.The unit describes how data is manipulated by operating systems and stored on devices such as hard disk drives and USB keys and how operating systems store and
organize data. Further, the unit explains how to locate data and describe its location in a directory structure.
3.Finally, the unit describes how hard disk drives are structured, organized, and formatted. This baseline hard disk drive information is a
crucial building block that the students should know about. The information will help them competently recover data from a hard disk drive as well as properly document the data's location on the drive.
4. Objectives-
1.Recognize the specific hardware, software, and media components of computer
systems and their importance to computer forensics.
1.1: Define the different fundamentals of computer data.
1.2: Define computer hardware components based on their functions.
1.3: Explain the types of computer software and their functions.
1.4: Identify the common operating systems and the functions they perform.
1.5: Identify how operating systems store potential digital evidence.
1.6: Define mass storage devices, optical media, and Flash-based media devices.

2.Identify types of digital evidence and locations where they are found.
2.1: Define digital evidence.
2.2: Define file types in which digital evidence is commonly found.
2.3: Identify file fragments and slack space where partial digital evidence files are found.
2.4: Define directory and subdirectory structures.
2.5: Define file path, file properties, and file access dates.
2.6: Examine storage folders or directories that contain digital evidence.
2.7: Examine the effects of file deletion on the ability to locate digital evidence.
5. Materials and Aids-
Chapters One and Two Power Point presentations.
Computer Lab Time
6. Procedures/Methods-

A. Introduction-

1.Ask the students to introduce themselves. Ask the students to rank their computer proficiency levels on a scale of 1 to 5, with 1 being lowest and 5 the highest. This information will help you determine the initial pace of the course and identify the students who may need extra assistance.

B. Development-

1.Follow the order of topics presented of the textbook and accompanying PowerPoint presentations.

C. Practice-

1.Ask the students to complete the learner activity on page 3 of the textbook to analyze data capacity measurements and how the measurements relate to one another.

D. Independent Practice-

1.Go to a Web site that sells computer hardware. Locate three items that store data, such as hard disk drives, USB keys, and CD-ROMs. Note down the
name of each item and its data capacity. For each item, convert its capacity into bits, bytes, and kilobytes (KB). The items will most likely be listed as having capacities in
megabytes (MB) or gigabytes (GB). Next, examine the price of each item. Lastly,
calculate the price per megabyte of storage.

E. Accommodations (Differentiated Instruction)-

This will depend on the students and their level assessed at the start of class.

F. Checking for understanding-

Review Lab Exercise in class.

G. Closure-

Review Important Concepts:
1.The identification and role of computer hardware, software, and operating
systems related to computer forensics
2.The hard disk drive structure, organization, and format; file allocation tables; and NT file system (NTFS)
3.Locations and types of digital evidence.

This Lesson Plan is available at (