IT 316: Computer Forensics

Examines digital forensic investigation principles and legal procedures. Students learn evidence identification, chain of custody preservation, digital forensic imaging, volatile memory analysis, file system artifacts recovery (NTFS/FAT), email forensics, and expert courtroom reporting standards.

• Digital forensics evidence handling: chain of custody maintenance and write-blocker forensic imaging in IT 316
• File system forensics: analyzing MFT records, deleted file carving, and timestamp artifacts (MACB) for Computer Forensics
• Volatile memory acquisition and analysis: extracting malware payloads and network sockets using Volatility in IT 316
• Registry and timeline analysis: USB artifact tracing, browser history reconstruction, and forensic report writing at Purdue Global