UNITAR International University : MQA-02 Bachelor of Information Technology (Hons) Attachment C

Summary of information on each course / module

1. Name of Course/Module PRINCIPLES OF COMPUTER FORENSICS
2. Course Code ITNB4314
3. Name(s) of academic staff Radin Izzatul Muna Binti Ahmad Zabidi
4. Rationale for the inclusion of the Computer Forensics deals with “the preservation, identification, extraction and
course/ module in the programme documentation of computer evidence.” This course discusses the principles of
computer forensics in terms of the processes required to carry out forensic
investigations, incident response, evidence analysis and recovery. It course covers
the recovery and analysis of digital evidence, addressing legal and technical
issues. It also discusses basic legal issues associated with computer forensic
examinations.
5. Semester and Year offered TBD (Specialisation Course)
6. Total Student Learning Time (SLT) Face to Face Online Total Guided and Independent Learning
Facilitation
T/S = Tutorial/Seminar T/S P F O
F= Forum 14 - 6 140 160
P = Practical
O= Others
7. Credit Value 4
8. Prerequisite (if any) ITNB2073 Data Communication and Computer Networking
ITNB2093 Computer Ethics and Cyber Laws
ITIB2093 Information Security
9. Objectives 1. To equip students with the principles and technical skills required in the
discipline of computer forensics.
2. To equip students with the knowledge of processes in forensic investigations.
3. To provide students with the knowledge to preserve digital evidence.
4. To equip students with the knowledge to act in response to an incident requiring
computer forensic investigation.
5. To introduce the legal expectations in carrying out forensic investigation.
10. Learning outcomes:

At the end of the course, students are able to:

LO1:Apply the principles of computer forensics in situations which require them.
LO2:Apply the concept of incident response in different situations.
LO3:Perform forensic investigative process according to legal expectations.
LO4:Gather, preserve, analyze and present digital evidence obtained from digital devices and medias.
LO5:State the necessary requirements for a computer forensic lab.
UNITAR International University : MQA-02 Bachelor of Information Technology (Hons) Attachment C

11. Transferable Skills:

TRANSFERABLE SKILLS Yes No

Knowledge 
Argument 
Practical 
Research 
Creativity 
Self-Appraisal 
Management of Learning 
Communication and Presentation 
Problem Solving and Contribution 
Interactive and Group Sk lls

UNITAR International University : MQA-02 Bachelor of Information Technology (Hons) Attachment C

12. Teaching-learning and assessment strategy:

TEACHING-LEARNING LO LO LO LO LO
1 2 3 4 5

Face-to-face learning (lecture, tutorial, discussion)     

Problem/action-based learning (assignment, exercises, lab work, programming,
cases, design, co  
king)
Cooperative learning (group discussions/activities/presentations)  
Technology-based learning (Internet search, games, mobile systems)
Experiential-based learning (field work, project paper, on-site visits)
Work-based lear ing
(Int
erns
hip,
Pra
ctic
um,
Coo
king
,
Wor
k
atta
chm
ents
)

Assessment strategy
Formative assessment (Online Forum Participation / TMA / Project / Presentation) - 50%
Summative assessment (Final Examination) - 50%

13. Synopsis:
This course discusses the principles of computer forensics in terms of the processes required to carry out forensic investigations.
The course also exposes the knowledge of how and who should act in response to an incident. It also discusses the techniques to
gather and handle digital evidence for the purposes of presentation in a court of law. The professional requirements of the computer
forensics practitioner will be incorporated throughout the syllabus of this module.

14. Mode of Delivery: Tutorial, Seminar, Forum, Discussion

15. Assessment Methods and Types
Continuous assessment:
50%
Online Forum Participation / TMA / Project / Presentation
Term end assessment:
50%
Final Examination
TOTAL 100%
UNITAR International University : MQA-02 Bachelor of Information Technology (Hons) Attachment C

16. Mapping of the Course/Module to the Programme Educational Objectives (PEO):

Refer to MQA-02 Area 1 : Item No 1.2.2 Table 2

17. Mapping of the Course Learning Outcomes (CLO) to the Programme Learning Outcomes (PLO)

Programme Learning Outcomes:

PLO1: Students are able to apply knowledge and skills in the field of information technology.
PLO2: Students are able to solve real world problem using information technology solution.
PLO3: Students are able to express ideas and opinions effectively in writing and oral presentation.
PLO4: Students are able to recognize and formulate new approach or method in providing IT solutions.
PLO5: Students are able to produce and deliver ideas and solution with entrepreneurial and managerial qualities.
PLO6: Students are able to participate in a project-based assignment at individual or team level.
PLO7: Students are able to complete assigned task while maintaining good professional ethics and social value.
PLO8: Students are able to discover new knowledge through informal sources and training.
PLO9: Students are able to relate the knowledge and skills of information technology to benefit the society.

Programme Learning Outcomes (PLO)

PLO1

PLO2

PLO3
PLO4
PLO5
PLO6
PLO7
PLO8

PLO9
Course Learning Outcomes (CLO)
Students are able to apply the principles of computer forensics in  
situations which require them.
Students are able to apply the concept of incident response in different   
situations 
Students are able to perform forensic investigative process according to   
legal expectations. 
Students are able to gather, preserve, analyze and present digital  
evidence obtained from digital devices and medias.
Students are able to state the necessary requirements for a computer  
forensic lab.
UNITAR International University : MQA-02 Bachelor of Information Technology (Hons) Attachment C

18. Content outline of the course/module and the SLT per topic:

Exam
Tutorial\Seminar Contents

Self-study

Assignment
Library Search
Forum

Total SLT (Hours)

Course

1. Fundamentals of Computer Forensics 2 6 16 3 25 160

-Introduction
-Objectives of computer forensics
-The need and use of computer forensics

2. Forensic Investigative Processes 2 16

-The principles of the investigative process in computer forensics,
including; preservation of computer based evidence, evidential
continuity, equipment identification and seizure, data collection, data
analysis
-Presentation of findings in format admissible to court of law.

3. Incident Response 2 16
-Definition
-Incident response rule
-Incident response for different situations
-Search and seizure
-Issues related to incident response

5. Incident Response Team 2 16

-Preventing an incident
-Categories of incidents
-The need of incident response team
-IRT staff
-Handling an incident
-IRTs around the world

4. Digital Evidence 2 16
-Nature of forensic evidence
-Types of devices
-Order of volatility and handling evidence
-Techniques for gathering, preserving, analyzing and presenting
digital evidence

6. Computer Forensic Lab 2 16

-Ergonomics of a computer forensic lab
-Computer forensic lab requirements

7. Legal Principles 2 16
-Legal aspects and legislation that can be applied to computer
forensics evidence
-The legal expectations in the gathering, preservation and
presentation of digital evidence so that it will be admissible in a court
of law

TOTAL HOURS 14 6 112 0 3 25 160

UNITAR International University : MQA-02 Bachelor of Information Technology (Hons) Attachment C

19. Main references supporting the course

Nelson, Phillips, Steuart (2014). Guide to Computer Forensics and Investigations 5th Edition, Cengage Learning.

Additional references supporting the course

1. Britz, M. J. (2013) Computer Forensics and Cyber Crime; an Introduction 3 rd Edition. Pearson.
2. Alan H. Cheung. (2011). Introduction to Computer Forensic. CreateSpace Independent Publishing Platform.
3. Gordon E Pelton. (2011). Introduction to Computer Forensics: With 33 Real Life Cases. CreateSpace Independent
Publishing Platform.

20. Other additional information: None