Nordic Computer Forensic Investigators - Module 3C Linux as an Investigative Platform

Study information

• Your learning outcomes

  The purpose of this study is to allow investigation of electronic traces using open source tools and to ensure the investigation is performed in a way that safeguards the rule of law and personal privacy.

  General competence

  After completion of the module candidates will be able to:

  • perform professional tasks in the role of digital forensic investigator with increased insight and confidence
  • see the role of digital forensics in a broader perspective during an investigation
  • identify ethical and legal issues during investigation

  
  Knowledge

  After completing the course candidates will have knowledge of:

  • the importance of open source tools in investigation
  • new methods and techniques for use in investigation
  • the automation of forensic techniques
  • the value of adapting tools for specific challenges
  • legal and ethical issues

  
  Skills

  After completion of the module candidates will be able to:

  • utilise the potential of open source tools
  • evaluate tools for customisation to different situations
  • develop scripts / tools for use in investigation
  • understand and customise other developers' scripts
  • evaluate the performance of both proprietary and open source tools

• Admission criteria

  The primary target group is police staff in the Nordic countries whose main task is handling and investigating digital evidence. It is a prerequisite that participants are selected in accordance with local competency plans.
  
  Employees in other International police services or governmental agencies who work, or will work, with digital evidence are also eligible to apply.

  Applicants for module 3C must:

  • possess higher Education Entrance Qualification
  • be employed by a national or local governmental agency
  • have passed NCFI Module 2A Advanced Computer Forensics, NCFI Module 2B Online Investigation or NCFI Module 2C Network Forensics and Cybercrime. The former NCFI Module 2 (25 ECTS) is also accepted
  • Have at least one year's experience in digital forensics or cybercrime investigation.

  
  Foreign applicants are only entitled to apply if:

  • the applicant's country has a partnership with PHS
  • they have been selected in accordance with the partner's competency plans
    
    

  Applicants who do not have the higher education entrance qualification have to provide:

  • a minimum of 5 years work experience, of which maximum 2 years can be education, replace the requirements for Higher Education Entrance Qualification. This arrangement only applies to applicants over the age of 25
    
    

  The prerequisite of having completed NCFI modules may be overridden if the applicant can:

  • either provide documentation for having completed equivalent education
  • or demonstrate qualifying skills and knowledge necessary to follow the module

  
  To be considered as equivalent education or qualifying experience, the following topic must be documented:

  • computer forensic methodology

  
  and in addition document education or experience in at least one of the following topics:

  • network forensics
  • cybercrime
  • mobile forensics 

  
  The total workload of the education should be equivalent to approximately 30 ECTS. For they who are applying on the basis of their experience, a relevant test will be provided in order to demonstrate necessary skills and knowledge.

• Practical information

  This course will be delivered on-line through a combination of lectures, exercises, quizzes and assignments. The approximate duration of the module is 210 hours. Students may choose to study at their own pace. However, it is expected that the course is completed within a single semester.

  During this course students will build a Linux-based forensic workstation. This will be created as a virtual machine. As such the student must install virtualisation software and then build the workstation throughout the course. Students will be guided through compulsory steps during this process. This work forms part of the final assessment. 

  The student needs to pass a number of course requirements in order to sit the exam.

  The study concludes with an exam consisting of two part; an individual take-home examination over 4 hours and assessment of the student's workstation configuration. Grading is from A – E, which are passing grades, and F, which is a failing grade. Both parts of the examination must be passed. Each part of the assessment has equal weight.

• Schedule for tuition and assesment

  Exam: 4-hour take-home examination and oral examination. Date: 01.12.2023 (Oral) 06.12.2023 (Take-home)

• Tuition fee

  A semester fee is required.

  An external student is defines as a student from another Nordic coutry, or an agency outside the police service (including police special agencies). The tuition fee is not applicable to students coming from insttitutions which have a reciprocal agreement with NPUC, or an agreement involving contributions to the study programme. The student fee is NOK 15 000,-.

• Contact information

  Academic questions

  Academic inquiries should be adressed to e-mail: cybercrime@phs.no.

  Questions relating to the admissions procedure

  Questions regarding the admission process (deadline, application process, documentation) should be adressed to e-mail: opptakevu@phs.no.

  Administrative questions about the study programme

  If you do not find what you are looking for, please send an email to: studiekontoret.oslo@phs.no

   

The course is one of a series of modules in the NCFI Programme

• All modules

  Nordic Computer Forensic Investigators - Introduction to Digital Policing

  Nordic Computer Forensic Investigators - Module 1 Core Concepts in Digital Investigation and Forensics

  Nordic Computer Forensic Investigators - Module 2A Advanced Computer Forensics

  Nordic Computer Forensic Investigators - Module 2B Online Investigation

  Nordic Computer Forensic Investigators - Module 2C Network Forensics and Cybercrime

  Nordic Computer Forensic Investigators - Module 2D Mobile Extraction and Artifacts

  Nordic Computer Forensic Investigators - Module 3A Forensic Tool Development

  Nordic Computer Forensic Investigators - Module 3B Linux Artifacts

  Nordic Computer Forensic Investigators - Module 3C Linux as an Investigative Platform

  Nordic Computer Forensic Investigators - Module 3D Macintosh Computer Forensics

  Nordic Computer Forensic Investigators - Module 3E Windows Forensics

  Nordic Computer Forensic Investigators - Module 3F Memory Investigation

  Nordic Computer Forensic Investigators - Module 3i Macintosh Forensics, Advanced

  Nordic Computer Forensic Investigators - Module 3K Report Generation Visualisation