48651 - Computer Forensics

Academic Year 2020/2021

  • Moduli: Raffaella Brighi (Modulo 1) Antonio Gammarota (Modulo 2)
  • Teaching Mode: Traditional lectures (Modulo 1) Traditional lectures (Modulo 2)
  • Campus: Bologna
  • Corso: Single cycle degree programme (LMCU) in Law (cod. 0659)

Learning outcomes

Subject of the course is the study of the legal and technological aspects for the search, acquisition, storage, analysis and evaluation of digital evidence.

Since the frequency and pervasiveness of technological innovation mean that there in practice is no legal trial without digital evidences. The correct application of legal rules require every legal operator (judges, lawyers, police, but also to clerks, custodians, consultants, experts, others) the obligation to be informed, receive training and continuous education in computer science, information technology and legal and computer forensics. On the other hand, computer scientists, in fact, need to know with precision the legal implications of their activities and therefore the principles of substantive law, procedural law and in particular the rules of seizure, collection and research of the evidence, to avoid errors during the investigation, often irreparable.

At the end of the course students will acquire more detailed knowledge about:

  • digital forensics legal rules regarding criminal and civil trial and any other kind of trial and procedure provided by the legal order;
  • technical activities regarding digital investigations and detrimental consequences in case of inobservance of the intrinsic characteristics of digital data;
  • methods and tools to correctly handle data and evidence before Courts: research, acquisition-storage of digital evidence, analysis and evaluation of digital data forming the evidence and analysis of the legal framework;
  • legal and technical evolution regarding the most recent innovation, as Cloud Forensics, geo-localization, wearable devices, Internet of Things, Open Source Intelligence (OSINT), Big Data, Health Digital data.

 

Course contents

The course will be structured in two sections.

The first section, 24 academic hours, will develop front lectures about the fundamentals of Digital Forensics, aiming to introduce students to the activities of research, acquisition-storage, analysis and evaluation and any other kind of management and interpretation of digital data to be evaluated as evidence before Court, with any due respect of technical and legal prescriptions.

The second section, 24 academic hours, will be structured in a seminar Lab where external experts (Lawyers, IT Specialists, Law Enforcement Officers) will intervene, deepening the most recent issues in a living discipline, making some practical demonstration. These lectures will consist in a speech given by the expert guest followed by a debate coordinated by the teacher.

Lectures will deal with the proposed issues in a strictly integrated and complementary way, analysing the legal and technical framework.

General Part

  • From Computer Forensics to Digital Forensics: role and perspectives of Digital Forensics. Junk Science in trial;
  • Digital data: from physical characteristics to legal implications
  • Legal sources, jurisdiction, competent court, international cooperation
  • Digital investigations and inquiries: the participating subjects (the Prosecutor and the Law Enforcement Officers, the defence attorney and the suspected; technical advisor and expert witness)
  • Issues and techniques to deal with digital data before Courts: research, acquisition, storage, analysis, evaluation
  • Operating procedures: methodology, best practices, standard ISO/IEC
  • Looking for digital evidence: inspections, searches, seizure, communication and data interception;
  • Digital evidence: digital documentary evidence, digital judicial test, examining digital suspects and witnesses;
  • Confiscating digital assets and extracting digital copies: legal and technical aspects;
  • Technical aspects: tools for digital data forensic analysis

Seminar Lab

  • Digital criminology and digital crimes
  • Digital data in web, mobile systems and telecom networks
  • Tools and techniques for environmental interception by telematics flows capturers
  • Tools and techniques for forensic data management in Cloud Computing
  • Digital Forensics for Companies
  • Health digital forensics
  • Digital Security: Network and Information Security Directive and its application; legal requirements for Network Security and Incident Response
  • Digital investigations, privacy and guarantees
  • Criminal IT systems and handling of digital evidence
  • Digital Forensics in transnational and European perspective

 

The programme is the same for all the students (attendees or not attendees), including also the ERASMUS students. The following sections provide methodological intructions for students who can not attend lessons.

Readings/Bibliography

Examination materials and bibliographic references are made available at the end of each lesson in the "Didactic Materials" section of this page.


Reference books are:
MAIOLI C. (a cura), Questioni di informatica forense, Aracne, 2015
CORASANITI G., CORRIAS LUCENTE G. (a cura), Cybercrime, responsabilita' degli utenti, prova digitale, Cedam, 2009
GHIRARDINI G., FAGGIOLI G., Computer forwensics, Apogeo, 2013
VACIAGO G., Digital evidence, Giappichelli, 2012

Teaching methods

Frontal Lectures

The course includes frontal lectures in the second semester. For the logistic details please visit the web site of the School of Law.

The course is divided into two modules: a general one, taught by Professor Raffaella Brighi, and the module “Legal aspects of Digital Forensics” taught by Professor Antonio Gammarota. Lectures, however, will consider any subject from a synergic standpoint integrating legal, methodologic and technical aspects, often involving both of teachers.

During the lectures the teacher uses slides, that are an outline of the main topics, including videos, practical sections. During the course the teacher may propose additional seminars about new emerging topics that are strongly connected with the discipline.

Attendance Rule

The attendance is not mandatory, but strongly reccomended for coping with the goals and the objectives of the course and for the seminar setting of the course. Attending the lectures the student may acquire rapidaly the technical terminology, the fundationals, the basis, and so to make progresses in the autonomous study methodology.

The students that not are able to attend the course should in any case download all the material, including slides, that the teacher provides during the lectures (see the section "Teaching tools"),and in any case please contact the teachers for any problem that you may have.

Assessment methods

The exam consists of an oral test that aims to verify the student's acquisition of knowledge as detailed in the course objectives, with reference to legal, methodological and technological profiles. The learned knowledge, critical and methodological skills of the student will be evaluated, and the competence to link parts of the program in an interdisciplinary way. The oral test is unique and valid for both modules.

Please use the information system of UNIBO "Almaesami" for subscribing to the written or oral exames.

Attending students
Attending students prepare a paper (the format of which will be explained in lesson) of a theme taught in lesson, which must be delivered to both teachers by email one week prior to the exam. The examination will focus mainly on the discussion of the report submitted.

Students will be recognized as having attended the course in the current academic year only if they will bring at the exam the relevant attendance form filled out and signed during the course, attesting that they have attended at least 2/3 of classes (32 hours).

Teaching tools

The section "teaching material" of this web site collects specific information on the course; questions of self-evaluation; slides projected in classroom and other supporting materials for the exam.

Teaching tools useful for the preparation of the exam are:
- the slides of lessons in the "Teaching Materials" section of this page, also available at http://campus.cib.unibo.it/
- papers and in-depth materials, mainly designed to address the most relevant topics in the current discipline (see Teaching Materials "on this page, accessible from http://campus.cib.unibo.it/)
- the "lessons register", which the teacher publishes, work in progress, at the end of each lesson (see 'Useful Content' section). It is advisable to organize the self-study by referring to the sequence of arguments as set in the lesson register.

Thesis

We offer thesis on the main emerging topics of the discipline. For a recent list of topics you can visit the section "Thesis" in this web page.

For requesting a thesis in Legal Informatics you must send an email with the following information: name, surname, degree name, year of enrolment, average of exams, number of exams missing, proposal of title and topic.

Office hours

See the website of Raffaella Brighi

See the website of Antonio Gammarota

SDGs

Quality education Reduced inequalities Peace, justice and strong institutions

This teaching activity contributes to the achievement of the Sustainable Development Goals of the UN 2030 Agenda.