This module aims to provide students with a comprehensive understanding of digital forensics, including relevant laws, procedures, and processes, as well as anti-forensic techniques. By the end of the module, students will be able to describe digital forensics and applicable legal frameworks, such as the Computer Crimes Act No 24 of 2007 in Sri Lanka and the Evidence (Special Provisions) Act of 1995. They will also be equipped to acquire and preserve electronic evidence, understand the characteristics of digital evidence (such as admissibility and authenticity), and detect anti-forensic techniques like data overwriting and encryption. The module covers key forensic procedures, including the identification, collection, preservation, examination, and analysis of digital evidence, and introduces tools like Autopsy, Wireshark, and Disk Imaging tools for handling digital data. Additionally, students will learn about data recovery, first responder protocols, timeline analysis, and the importance of procedural documentation in forensic investigations.
