B8955 - Digital Forensis and Computer Evidence

Learning outcomes

Digital forensics is the forensic science of identifying, collecting, and interpreting digital data from computing devices and networks in order to derive evidence useful for investigative activities or admissible in legal proceedings, assessable by the judge. The frequency and pervasiveness of technological innovation today result in the presence of digital evidence in any type of legal proceeding and even in extrajudicial activities. At the end of the course, the student will: - be able to navigate the fundamental principles related to the evidentiary process; - have an in-depth understanding of laws, protocols, and methodological standards for the proper management of digital data and evidence; - master technical activities within IT-related investigations and understand the adverse consequences of failing to adhere to the best pratices; - be capable of addressing and/or resolving the most common issues arising in judicial practice concerning digital evidence; - be familiar with legal and technical developments regarding the latest technological innovations, such as cloud forensics, geolocations, crypto assets, Internet of Things, Open Source Intelligence (OSINT), and Artificial Intelligence.

Course contents

he course takes place in the second semester and is divided into two distinct parts.

The first part, comprising 30 hours, consists of frontal lectures on the fundamentals of digital forensics. Its aim is to introduce students to the proper handling of digital evidence so that it may be admitted in court, in full compliance with applicable legal and technical standards.
The second part, totaling 18 hours, is organized as a seminar‑laboratory in which external speakers—legal practitioners, information‑security experts, and law‑enforcement representatives—will explore the most current challenges in this ever‑evolving discipline, often supported by hands‑on demonstrations. Each session will feature a presentation by the invited expert, followed by a moderated discussion led by the course instructor.

Throughout both sections, lessons will integrate legal and technical perspectives in a fully complementary manner.

General Module
From Computer Forensics to Digital Forensics: history, role, and future prospects of forensic computing
Digital evidence and “bad science” in litigation
The digital artifact: from its physical characteristics to its legal implications
Key actors, roles, and required competencies
Legal and technical challenges in the processing of digital evidence for forensic purposes: identification, acquisition, preservation, analysis, and evaluation
Operational practices: methodologies, best practices, and technical standards
Presentation of digital evidence: technical reports and supporting documentation
Forensic analysis of storage media (disk forensics), mobile devices (mobile forensics), and network traffic (network forensics): technical approaches and related legal issues
Network data interception, encrypted phones, and trojans
The impact of artificial intelligence on forensic computing
Forensic computing in corporate environments
Forensic computing and cybersecurity

Seminar‑Laboratory
The seminars examine recent technological innovations—such as cloud forensics, geolocation, wearable devices, the Internet of Things, Open Source Intelligence (OSINT), Big Data, and digital health records—and analyze their legal and technical ramifications.

Each year, the seminar topics are updated to reflect the most relevant and timely issues. Among those covered in recent years are:
• Digital evidence on the web, in mobile systems, and across telecommunications networks
• Techniques and tools for ambient recording (surveillance devices) and interception of network traffic
• Forensic methods for data processing in cloud computing environments
• Corporate forensic computing
• Forensic computing in healthcare
• Investigations involving digital devices, privacy considerations, and legal safeguards
• Criminal‑justice information systems and the management of seized digital evidence
• Transnational and European perspectives on digital forensics
• Applications of artificial intelligence in forensic computing
• Data‑breach investigations and the Forensics Readiness Plan
• Open Source Intelligence in investigations: challenges and prospects for cyber‑investigation
• From OSINT to cryptocurrency seizure
• Digital evidence in the workplace
• Criminal investigations in the era of encryption: challenges, techniques, and limits to accessing digital evidence
• Protection of intellectual property: network monitoring and enforcement tools
• Artificial intelligence and civil litigation

The curriculum is identical for both attending and non‑attending students, as well as for those enrolled through the ERASMUS program. The following sections provide methodological guidance specifically for students who are unable to attend the lectures.

Readings/Bibliography

The materials for exam preparation and bibliographic references are made available on the Virtual platform at the end of each lesson.

The in-depth texts used in the preparation of the lessons include:

• BRIGHI R. (a cura) Nuove questioni di informatica forense, Roma, Aracne Editore, 2022, pp. 491 (liberamente scaricabile al link: https://www.aracneeditrice.eu/free-download/9791259946430.pdf
  
• MAIOLI C. (a cura), Questioni di informatica forense, Aracne, 2015

• BRIGHI R.; FERRAZZANO M., Digital forensics: best practices and perspective in: Digital Forensic Evidence: Towards Common European Standards in Antifraud Administrative and Criminal Investigations, Milano, Wolters Kluwer/CEDAM, 2021, pp. 13 - 48 (COLLEZIONE DI GIUSTIZIA PENALE). Liberamente scaricabile al link: https://site.unibo.it/devices/en/results

• Raffaella Brighi, Una governance integrata per nuovi modelli dell'informatica forense [http://www.i-lex.it/index.php/volume-11/fascicolo-11-1/11-una-governance-integrata-per-nuovi-modelli-dell-informatica-forense], «I-LEX [http://www.i-lex.it/index.php/volume-11/fascicolo-11-1/11-una-governance-integrata-per-nuovi-modelli-dell-informatica-forense] », 2017, 11-1, pp. 45 - 70

• FERRAZZANO M., Aspetti metodologici, giuridici e tecnici nel trattamento di reperti informatici nei casi di pedopornografia, ARACNE (2018)- Capitoli 1 e 2.

• Others will be recommended during the lectures.

Teaching methods

Frontal Lectures

The course includes frontal lectures in the second semester. For the logistic details please visit the web site of the School of Law.

Lectures, however, will consider any subject from a synergic standpoint integrating legal, methodologic and technical aspects.

During the lectures the teacher uses slides, that are an outline of the main topics, including videos, practical sections. During the course the teacher may propose additional seminars about new emerging topics that are strongly connected with the discipline.

Attendance Rule

The attendance is not mandatory, but strongly reccomended for coping with the goals and the objectives of the course and for the seminar setting of the course. Attending the lectures the student may acquire rapidaly the technical terminology, the fundationals, the basis, and so to make progresses in the autonomous study methodology.

The students that not are able to attend the course should in any case download all the material, including slides, that the teacher provides during the lectures (see the section "Teaching tools"),and in any case please contact the teachers for any problem that you may have.

Assessment methods

The exam consists of an oral test that aims to verify the student's acquisition of knowledge as detailed in the course objectives, with reference to legal, methodological and technological profiles. The learned knowledge, critical and methodological skills of the student will be evaluated, and the competence to link parts of the program in an interdisciplinary way. The oral test is unique and valid for both modules.

Please use the information system of UNIBO "Almaesami" for subscribing to the written or oral exames.

By way of example, the following criteria will be used to assess the final mark (that will be out of 30/30):

• sufficient or barely sufficient knowledge on the programme, limited reasoning ability, some difficulties in using technical and legal language → 18-21/30;
• fairly good knowledge of the programme, adequate critical reasoning ability, sound use of technical and legal language → 22-25/30;
• comprehensive knowledge of the programme, notable reasoning ability, good command of technical and legal language → 26-29/30;

• extensive knowledge of the programme, very good reasoning ability, and ability to fully master technical-legal language → 30-30L/30.

Attending students
Attending students prepare a paper (the format of which will be explained in lesson) of a theme taught in lesson, which must be delivered to both teachers by email one week prior to the exam. The examination will focus mainly on the discussion of the report submitted.

Students will be recognized as having attended the course in the current academic year only if they will bring at the exam the relevant attendance form filled out and signed during the course, attesting that they have attended at least 2/3 of classes (32 hours).

Students with learning disorders and/or temporary or permanent disabilities: please contact the office responsible (https://site.unibo.it/studenti-con-disabilita-e-dsa/en/for-students ) as soon as possible so that they can propose acceptable adjustments. The request for adaptation must be submitted in advance (15 days before the exam date) to the lecturer, who will assess the appropriateness of the adjustments, taking into account the teaching objectives.

 

Teaching tools

The section "teaching material" of this web site collects specific information on the course; questions of self-evaluation; slides projected in classroom and other supporting materials for the exam.

Teaching tools useful for the preparation of the exam are:
- the slides of lessons in the "Teaching Materials" section of this page.
- papers and in-depth materials, mainly designed to address the most relevant topics in the current discipline (see Teaching Materials "on this page)

Thesis

We offer thesis on the main emerging topics of the discipline. For a recent list of topics you can visit the section "Thesis" in this web page.

For requesting a thesis in Legal Informatics you must send an email with the following information: name, surname, degree name, year of enrolment, average of exams, number of exams missing, proposal of title and topic.

Office hours

See the website of Raffaella Brighi