Students

COMP2310 – Digital Forensics

2025 – Session 1, In person-scheduled-weekday, North Ryde

General Information

Download as PDF
Unit convenor and teaching staff Unit convenor and teaching staff Convenor
Dinusha Vatsalan
Lecturer
Natasha Fernandes
Lecturer
Muhammad Ikram
Credit points Credit points
10
Prerequisites Prerequisites
COMP1010 and COMP1350
Corequisites Corequisites
COMP2250 or COMP2270
Co-badged status Co-badged status
Unit description Unit description

This unit provides an introduction to digital forensics and incident response methods, techniques and tools. Strong emphasis is given to ethics, the laws and procedures as students are exposed to forensics techniques used to collect and recover data. Students are taught how to conduct digital investigations following the process of preserving, acquiring, analysing and presenting digital evidence.

Learning in this unit enhances student understanding of global challenges identified by the United Nations Sustainable Development Goals (UNSDGs) Industry, Innovation and Infrastructure

Important Academic Dates

Information about important academic dates including deadlines for withdrawing from units are available at https://www.mq.edu.au/study/calendar-of-dates

Learning Outcomes

On successful completion of this unit, you will be able to:

  • ULO1: Adhere to highest ethical standards, obey the laws and follow procedures at all times when collecting and dealing with digital evidence.
  • ULO2: Develop and follow suitable processes when performing incident response and conducting digital forensics investigations.
  • ULO3: Use appropriate tools and techniques to collect and recover data from a variety of digital sources.
  • ULO4: Communicate effectively the results of an investigation following professional standards.

General Assessment Information

Release Dates

Assignment 1 (individual assignment) - release date Week 2 Friday 07/03/2025 23:55pm.

Assignment 2 (group assignment) - release date Week 7 Friday 11/04/2025 23:55pm. Group nominations start from Week 2 Monday 03/02/2025.

 

Descriptions of Assessment Activities and Other Information

  • Assessment Criteria - Rubrics for assignment 1 and assignment 2 will be released in iLearn by the respective release dates.
  • Submission of Assessments - Assessments need to be submitted via iLearn.
  • Marking of Assessments - Marks and feedback will be provided via iLearn with a turn-around time of 2.5 weeks for the assignments and 1.5 week for the weekly tasks and module exams.

 

Requirements to Pass this Unit

To pass this unit you must:

  1. Attempt all assessments
  2. Achieve a total mark equal to or greater than 50%, and,
  3. Participate in, and undertake all hurdle activities for a minimum of 50% on 8 out of 12 weekly tasks and 50% on each module exam.

 

Hurdle Assessments

Weekly tasks (10%):

Development of knowledge and skills requires continual practice at authentic problems. This unit has weekly tasks and you must demonstrate your progress in developing and communicating knowledge and skills in a minimum of 8 of the 12 weekly submissions. Some of these tasks require written submissions, while some are multiple choice qustions. 8 out of the 12 weekly submissions are designated as hurdle requirements. This is a hurdle assessment meaning that failure to meet this requirement may result in a fail grade for the unit. To meet the passing criteria, you must achieve a minimum score of 50% on 8 submissions. 

 

Module exams (45%)

Similarly, module exams are also considered as hurdle requirements, with a minimum passing mark of 50% for each exam. This unit does not have a final exam, but instead it has 3 module exams over the semester. The topics of this unit are categorised into 3 modules (see below). Developing a good understanding of each of the 3 modules is important for this unit and is assessed as a hurdle requirement to pass the unit.

 

Late Assessment Submission Penalty

Unless a Special Consideration request has been submitted and approved, a 5% penalty (of the total possible mark of the task) will be applied for each day a written report or presentation assessment is not submitted, up until the 7th day (including weekends). After the 7th day, a grade of ‘0’ will be awarded even if the assessment is submitted. The submission time for all uploaded assessments is 11:55 pm. A 1-hour grace period will be provided to students who experience a technical concern. For any late submission of time-sensitive tasks, such as scheduled tests/exams, performance assessments/presentations, and/or scheduled practical assessments/labs, please apply for Special Consideration. For example, if the assignment is worth 8 marks (of the entire unit) and your submission is late by 19 hours (or 23 hours 59 minutes 59 seconds), 0.4 marks (5% of 8 marks) will be deducted. If your submission is late by 24 hours (or 47 hours 59 minutes 59 seconds), 0.8 marks (10% of 8 marks) will be deducted, and so on.

Assessments where Late Submissions will be accepted:

  • Assignment 1 and Assignment 2 – YES, Standard Late Penalty applies
  • Weekly Tasks and Module Exams - NO, unless Special Consideration is Granted

 

Special Consideration

The Special Consideration Policy aims to support students who have been impacted by short-term circumstances or events that are serious, unavoidable and significantly disruptive, and which may affect their performance in assessment.

Written Assessments (Assignment 1 and 2): If you experience circumstances or events that affect your ability to complete the written assessments in this unit on time, please inform the convenor and submit a Special Consideration request through http://connect.mq.edu.au/.

Weekly tasks: To pass the unit you need to demonstrate ongoing development of skills and application of knowledge in 8 out of 12 of the weekly tasks. If you miss at least 8 weekly tasks submissions due to a serious, unavoidable and significant disruption, contact your convenor and submit a Special Consideration request through http://connect.mq.edu.au/. Note that a Special Consideration should only be applied for if you miss more than four of the weekly tasks.

Module exams: Three module exams covering the three modules of this unit will be conducted over the semester (in weeks 5, 9 and 13). To pass this unit, you must achieve at least 50% mark in each of the 3 module exams. If you miss an exam due to a serious, unavoidable and significant disruption, contact your convenor and submit a Special Consideration request through http://connect.mq.edu.au/

Assessment Tasks

Name Weighting Hurdle Due
Assignment 1 20% No Due Friday 11/04/2025 23:55pm
Assignment 2 25% No Due Friday 30/05/2025 23:55pm
Weekly Tasks 10% Yes Due weeks 2 to 13 Wednesdays 23:55pm
Module Exams 45% Yes 28/03/2025, 09/05/2025, and 06/06/2025 09:00am--21:00pm

Assignment 1

Assessment Type 1: Project
Indicative Time on Task 2: 15 hours
Due: Due Friday 11/04/2025 23:55pm
Weighting: 20%

 

This assignment deals with the recovery of digital evidence. The assignment is to be submitted via iLearn.

 


On successful completion you will be able to:
  • Adhere to highest ethical standards, obey the laws and follow procedures at all times when collecting and dealing with digital evidence.
  • Use appropriate tools and techniques to collect and recover data from a variety of digital sources.
  • Communicate effectively the results of an investigation following professional standards.

Assignment 2

Assessment Type 1: Project
Indicative Time on Task 2: 15 hours
Due: Due Friday 30/05/2025 23:55pm
Weighting: 25%

 

This group assignment deals with the response to an incident. It involves following defined procedures to recover and present evidence. It features the submission of a report and a presentation. The assignment is to be submitted via iLearn.

 


On successful completion you will be able to:
  • Adhere to highest ethical standards, obey the laws and follow procedures at all times when collecting and dealing with digital evidence.
  • Develop and follow suitable processes when performing incident response and conducting digital forensics investigations.
  • Use appropriate tools and techniques to collect and recover data from a variety of digital sources.
  • Communicate effectively the results of an investigation following professional standards.

Weekly Tasks

Assessment Type 1: Quiz/Test
Indicative Time on Task 2: 15 hours
Due: Due weeks 2 to 13 Wednesdays 23:55pm
Weighting: 10%
This is a hurdle assessment task (see assessment policy for more information on hurdle assessment tasks)

 

Each week, a set of exercises will be available online. Some require written submissions, while some are multiple choice. Your solutions should be submitted electronically via iLearn before the deadline specified in the text.

 


On successful completion you will be able to:
  • Adhere to highest ethical standards, obey the laws and follow procedures at all times when collecting and dealing with digital evidence.
  • Develop and follow suitable processes when performing incident response and conducting digital forensics investigations.
  • Use appropriate tools and techniques to collect and recover data from a variety of digital sources.
  • Communicate effectively the results of an investigation following professional standards.

Module Exams

Assessment Type 1: Examination
Indicative Time on Task 2: 30 hours
Due: 28/03/2025, 09/05/2025, and 06/06/2025 09:00am--21:00pm
Weighting: 45%
This is a hurdle assessment task (see assessment policy for more information on hurdle assessment tasks)

 

Three Module examinations are conducted over the semester.

 


On successful completion you will be able to:
  • Adhere to highest ethical standards, obey the laws and follow procedures at all times when collecting and dealing with digital evidence.
  • Develop and follow suitable processes when performing incident response and conducting digital forensics investigations.
  • Use appropriate tools and techniques to collect and recover data from a variety of digital sources.
  • Communicate effectively the results of an investigation following professional standards.

1 If you need help with your assignment, please contact:

  • the academic teaching staff in your unit for guidance in understanding or completing this type of assessment
  • the Writing Centre for academic skills support.

2 Indicative time-on-task is an estimate of the time required for completion of the assessment task and is subject to individual variation

Delivery and Resources

COMPUTING FACILITIES

Please note that COMP2310 is a BYOD (Bring Your Own Device). You will be expected to bring your own laptop computer (Windows, Mac or Linux) to the workshop, install and configure the required software, and incorporate secure practices into your daily work (and play!) routines.

 

CLASSES

Each week you should complete any assigned readings and review the lecture slides in order to prepare for the lecture. There are three hours of lectures and a one-hour workshop every week. The hands-on exercises in works help to reinforce concepts introduced during the lectures. You should have chosen a practical on enrollment. You will find it helpful to read the workshop instructions before attending - that way, you can get to work quickly! For details of days, times and rooms consult the timetables webpage.

You should have selected a practical at enrollment. Please note that you will be required to submit work every week. Failure to do so may result in you failing the unit or being excluded from the exam.

 

WEEK 1 CLASSES

Lectures and workshops commence in week 1. You should have chosen a practical/workshop on enrollment. You will find it helpful to read the workshop instructions before attending - that way, you can get to work quickly! For details of days, times and rooms consult the timetables webpage.

 

DISCUSSION BOARDS

This unit makes use of discussion boards hosted within iLearn. Please post questions there; they are monitored by the staff on the unit.

 

METHODS OF COMMUNICATION

We will communicate with you via your university email and through announcements on iLearn. Queries to convenors can either be placed on the iLearn discussion board or sent to the unit convenor via the contact email on iLearn.

 

RECOMMENDED TEXTS

  • Guide to Computer Forensics and Investigations, by Bill Nelson, Amelia Phillips, Christopher Steuart, 6th edition, Cengage Learning, 2019.

  • Digital Forensics and Investigations People, Process, and Technologies to Defend the Enterprise, by Jason Sachowski, 1st edition, 2018.

 

TECHNOLOGY USED

iLearn

iLearn is a Learning Management System that gives you access to lecture slides, lecture recordings, forums, assessment tasks, instructions for practicals, discussion forums and other resources.

Unit Schedule

The topics covered in this unit are as follows:

Module 1 ( Weeks 1 to 4)

  • Computer Forensics and Investigation Processes
  • Understanding Computing Investigations
  • The Investigator's Office and Laboratory
  • Data Acquisitions
  • Processing Crime and Incident Scenes

Module 2 (Weeks 5 to 8)

  • Working with Windows and DOS Systems
  • Computer Forensics Tools
  • File Systems
  • Recovering Graphics Files
  • Recovering data from memory/hardware
  • Digital Forensics Analysis and Validation

Module 3 (Weeks 9 to 13)

  • Virtual Machines, Network Forensics, and Live Acquisitions
  • E-mail Investigations
  • Cell Phone and Mobile Device Forensics
  • Report Writing for High-Tech Investigations
  • Expert Testimony in High-Tech Investigations
  • Ethics and High-Tech Investigations

Policies and Procedures

Macquarie University policies and procedures are accessible from Policy Central (https://policies.mq.edu.au). Students should be aware of the following policies in particular with regard to Learning and Teaching:

Students seeking more policy resources can visit Student Policies (https://students.mq.edu.au/support/study/policies). It is your one-stop-shop for the key policies you need to know about throughout your undergraduate student journey.

To find other policies relating to Teaching and Learning, visit Policy Central (https://policies.mq.edu.au) and use the search tool.

Student Code of Conduct

Macquarie University students have a responsibility to be familiar with the Student Code of Conduct: https://students.mq.edu.au/admin/other-resources/student-conduct

Results

Results published on platform other than eStudent, (eg. iLearn, Coursera etc.) or released directly by your Unit Convenor, are not confirmed as they are subject to final approval by the University. Once approved, final results will be sent to your student email address and will be made available in eStudent. For more information visit connect.mq.edu.au or if you are a Global MBA student contact globalmba.support@mq.edu.au

Academic Integrity

At Macquarie, we believe academic integrity – honesty, respect, trust, responsibility, fairness and courage – is at the core of learning, teaching and research. We recognise that meeting the expectations required to complete your assessments can be challenging. So, we offer you a range of resources and services to help you reach your potential, including free online writing and maths support, academic skills development and wellbeing consultations.

Student Support

Macquarie University provides a range of support services for students. For details, visit http://students.mq.edu.au/support/

Academic Success

Academic Success provides resources to develop your English language proficiency, academic writing, and communication skills.

The Library provides online and face to face support to help you find and use relevant information resources. 

Student Services and Support

Macquarie University offers a range of Student Support Services including:

Student Enquiries

Got a question? Ask us via the Service Connect Portal, or contact Service Connect.

IT Help

For help with University computer systems and technology, visit http://www.mq.edu.au/about_us/offices_and_units/information_technology/help/

When using the University's IT, you must adhere to the Acceptable Use of IT Resources Policy. The policy applies to all who connect to the MQ network including students.

Changes from Previous Offering

We value student feedback to be able to continually improve the way we offer our units. As such we encourage students to provide constructive feedback via student surveys, to the teaching staff directly, or via the FSE Student Experience & Feedback link in the iLearn page.

 

Student feedback from the previous offering of this unit was very positive overall, with students pleased with the clarity around assessment requirements and the level of support from teaching staff. As such, no change to the delivery of the unit is planned, however we will continue to strive to improve the level of support and the level of student engagement.

Changes since First Published

Date Description
19/02/2025 There is a typo in the released date for Assignment 1. It is released on Week 2 Friday 07/03/2025 23:55pm, not on 07/04/2025.

Unit information based on version 2025.07 of the Handbook