55AA Security Lab

55AA-015

Digital Forensics and Attribution

Level
Graduate
Status
Under development

Note: this course is still being designed and calibrated; the page content is for reference and does not represent the final teaching version.

Syllabus

Course Overview

Digital Forensics and Attribution trains students to collect, preserve, analyze, and explain digital evidence under legal, ethical, and technical constraints. Topics include disk, memory, logs, network, mobile and cloud evidence, attack-chain reconstruction, and confidence-aware attribution.

This course applies system security, operating systems, and networking knowledge to incident response and evidence analysis.

Prerequisites

  • Operating systems, networking, and system-security fundamentals.
  • Ability to use Linux, scripting, and common log tools.
  • Willingness to follow evidence-handling and privacy rules strictly.

Learning Outcomes

  • Establish preservation, hashing, and chain-of-custody procedures.
  • Analyze disk, memory, log, and network evidence.
  • Reconstruct attack timelines and key actions.
  • Separate facts, inferences, and attribution confidence.
  • Write forensic reports for technical and nontechnical readers.

Course Format

  • Two meetings per week: one for core concepts and one for labs, paper discussion, or project review.
  • The course proceeds over 16 weeks, each with a checkable assignment, lab, or project milestone.
  • Reproducibility is required: code, configuration, data, lab logs, and reports must be reviewable by staff or peers.

Weekly Plan

Week 1
Week 2

Evidence, legal ethics, and chain of custody: lab and review

Complete imaging, hashing, and evidence-record exercises. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 3Evidence, legal ethics, and chain of custody: lab and review: Concepts, Cases, and Method90 minSession 4Evidence, legal ethics, and chain of custody: lab and review: Lab, Review, and Transfer90 min
Week 3
Week 4

File-system and disk forensics: lab and review

Recover deleted files and explain metadata. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 7File-system and disk forensics: lab and review: Concepts, Cases, and Method90 minSession 8File-system and disk forensics: lab and review: Lab, Review, and Transfer90 min
Week 5
Week 6

Memory forensics and process artifacts: lab and review

Analyze processes and connections in a memory image. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 11Memory forensics and process artifacts: lab and review: Concepts, Cases, and Method90 minSession 12Memory forensics and process artifacts: lab and review: Lab, Review, and Transfer90 min
Week 7
Week 8

Logs, timelines, and event correlation: lab and review

Build a multi-source event timeline. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 15Logs, timelines, and event correlation: lab and review: Concepts, Cases, and Method90 minSession 16Logs, timelines, and event correlation: lab and review: Lab, Review, and Transfer90 min
Week 9
Week 10

Network forensics and traffic reconstruction: lab and review

Reconstruct sessions and attack phases from pcap. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 19Network forensics and traffic reconstruction: lab and review: Concepts, Cases, and Method90 minSession 20Network forensics and traffic reconstruction: lab and review: Lab, Review, and Transfer90 min
Week 11
Week 12

Cloud, container, and identity logs: lab and review

Analyze privilege abuse in cloud audit logs. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 23Cloud, container, and identity logs: lab and review: Concepts, Cases, and Method90 minSession 24Cloud, container, and identity logs: lab and review: Lab, Review, and Transfer90 min
Week 13
Week 14

Attribution, deception, and confidence: lab and review

Write attribution hypotheses and evidence tables for a case. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 27Attribution, deception, and confidence: lab and review: Concepts, Cases, and Method90 minSession 28Attribution, deception, and confidence: lab and review: Lab, Review, and Transfer90 min
Week 15
Week 16

Forensic reporting and expert testimony: lab and review

Submit the final forensic report and reproducibility package. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 31Forensic reporting and expert testimony: lab and review: Concepts, Cases, and Method90 minSession 32Forensic reporting and expert testimony: lab and review: Lab, Review, and Transfer90 min

Assessment

Individual assignments

Concept questions, reading responses, design tasks, and small programming or lab exercises.

25%
Labs and project

Forensic workflow, evidence analysis, timeline, and report.

40%
Participation and review

Participation in discussions, demos, code or paper reviews, and peer feedback.

10%
Final report and defense

Submit reproducible artifacts, a technical report, and a demo explaining methods, results, limitations, and future work.

25%

Course Project

Students complete a simulated incident-response case, reconstructing the attack process, key indicators, impact scope, and attribution confidence from raw evidence.

Policies

  • AI tools are allowed, but generated code, lab notes, and design suggestions must be reviewed by the student and disclosed in the report.
  • Students may not submit code, proofs, configuration, or experimental results they cannot explain; each member must defend their own design, tests, and tradeoffs.
  • Late work affects iteration grades, but the course values reproducible, auditable, and maintainable results over last-minute accumulation.

Reference Courses

International

China 985 Universities