| |
Subject: Computer Forensics |
|
1. Topic-
|
| Computer Hardware, Software and Operating Systems |
| |
|
2. Content-
|
| Investigating High Tech Crime, Chapters One and Two. |
| |
|
3. Goals: Aims/Outcomes-
|
1.Unit 1 is intended to familiarize the students with basic data
structures, types of computer hardware and software, the structure
and functions of the Internet, and how data is routed.
2.The unit describes how data is manipulated by operating systems
and stored on devices such as hard disk drives and USB keys and how
operating systems store and
organize data. Further, the unit explains how to locate data and describe
its location in a directory structure.
3.Finally, the unit describes how hard disk drives are structured,
organized, and formatted. This baseline hard disk drive information
is a
crucial building block that the students should know about. The information
will help them competently recover data from a hard disk drive as
well as properly document the data's location on the drive. |
| |
|
|
4. Objectives-
|
1.Recognize the specific hardware, software, and media components
of computer
systems and their importance to computer forensics.
1.1: Define the different fundamentals of computer data.
1.2: Define computer hardware components based on their functions.
1.3: Explain the types of computer software and their functions.
1.4: Identify the common operating systems and the functions they
perform.
1.5: Identify how operating systems store potential digital evidence.
1.6: Define mass storage devices, optical media, and Flash-based media
devices.
2.Identify types of digital evidence and locations where they are
found.
2.1: Define digital evidence.
2.2: Define file types in which digital evidence is commonly found.
2.3: Identify file fragments and slack space where partial digital
evidence files are found.
2.4: Define directory and subdirectory structures.
2.5: Define file path, file properties, and file access dates.
2.6: Examine storage folders or directories that contain digital evidence.
2.7: Examine the effects of file deletion on the ability to locate
digital evidence. |
| |
|
5. Materials and Aids-
|
Chapters One and Two Power Point presentations.
Computer Lab Time |
| |
|
6. Procedures/Methods-
|
|
A. Introduction-
| 1.Ask the students to introduce themselves. Ask the students to
rank their computer proficiency levels on a scale of 1 to 5, with
1 being lowest and 5 the highest. This information will help you determine
the initial pace of the course and identify the students who may need
extra assistance. |
| |
|
|
B. Development-
| 1.Follow the order of topics presented of the textbook and accompanying
PowerPoint presentations. |
| |
|
|
C. Practice-
| 1.Ask the students to complete the learner activity on page 3 of
the textbook to analyze data capacity measurements and how the measurements
relate to one another. |
| |
|
|
D. Independent Practice-
1.Go to a Web site that sells computer hardware. Locate three items
that store data, such as hard disk drives, USB keys, and CD-ROMs.
Note down the
name of each item and its data capacity. For each item, convert its
capacity into bits, bytes, and kilobytes (KB). The items will most
likely be listed as having capacities in
megabytes (MB) or gigabytes (GB). Next, examine the price of each
item. Lastly,
calculate the price per megabyte of storage. |
| |
|
|
E. Accommodations (Differentiated Instruction)-
| This will depend on the students and their level assessed at the
start of class. |
| |
|
|
F. Checking for understanding-
| Review Lab Exercise in class. |
| |
|
|
G. Closure-
Review Important Concepts:
1.The identification and role of computer hardware, software, and
operating
systems related to computer forensics
2.The hard disk drive structure, organization, and format; file allocation
tables; and NT file system (NTFS)
3.Locations and types of digital evidence. |
| |
|