TSIT14 · 6 credits · Advanced level (A1F) · Informationsteknologi, Datateknik, Datavetenskap
Digital Forensics and Incident Response
Active · next start HT 2026
100%
passed the latest ordinary exam
TEN1 · 30 Oct 2025 · 39 students
100%
passed the ordinary exams, all sittings over the last 5 years
TEN1 · 79 students
Part of 4 programmes
Exam
TEN1 Written examination
- 5
- 4
- 3
Ordinary exams
100% passed · 79 students
- 100%39
- 100%40
Re-exams
No sittings with at least 5 students.
- Get 4 or 5: 86% (79 students)
Show small sittings (2)
Sittings with fewer than 5 students, often credit transfers or special sittings. They are not part of any figure on this page.
- 100%2
- 100%1
Other modules
Partial exams, hand-ins and labs. They are not part of the figures at the top.
Hand-in or lab
LAB1 Laboratory work
- G
Main rounds
100% passed · 76 students
- 100%39
- 100%37
Later rounds
No sittings with at least 5 students.
Show small sittings (2)
Sittings with fewer than 5 students, often credit transfers or special sittings. They are not part of any figure on this page.
- 100%2
- 100%2
About the course
Aim
The course covers the basic requirements, methodologies, and limitations of digital forensics and incident response, including techniques for identifying, securing, and evaluating digital evidence in various systems.
After completing the course, the student is expected to:
- Comprehend and explain the fundamental theories and principles of digital forensics and incident response.
- Comprehend and describe methodologies, challenges, and tools used in digital forensics and incident response across various systems.
- Implement, evaluate and document forensic investigations by interpreting digital evidence and utilizing forensic tools.
Content
During the course the following subjects will be included:
- Network forensics
- Incident response
- Digital forensics on hardware
- Mobile forensics
- Memory forensics
- Forensics on image and video
- Log management, preserving evidence
- Particulars of SCADA environments and critical infrastructure
- Theoretical models
- Advanced and narrow topics, e.g., adversary simulation
- Laws and use of digital forensic material as evidence
- Examiner
- Shizhen Chang
- Scheduled hours
- 40 h
- Main field of study
- Informationsteknologi, Datateknik, Datavetenskap