Unit 31 Forensics Assignment Brief 2026
| Qualification | Pearson BTEC Levels 4 and 5 Higher Nationals in Computing |
| Unit Number | 31 |
| Unit Title | Forensics |
| Unit code | T/618/7444 |
| Unit type | Optional |
| Unit level | 5 |
| Credit value | 15 |
Introduction
This unit introduces students to digital forensics involving the use of specialised techniques to investigate the recovery, authentication and analysis of data on electronic data storage devices, as well as network security breaches and cyber attacks, using different tools and techniques.
With the current widespread use of digital devices, digital forensics has become an important part of the detection of crime by being able to identify details of what has been stored on digital devices in the past. Students will have the opportunity to learn about some of the lower-level structures of data storage devices and the techniques used to investigate them.
Among the topics included in this unit are: describing the process of carrying out digital forensics; forensic investigation legal guidelines and procedures; understanding low-level file structures of several operating systems (OS); creating a book disk to enable forensic examination of devices and undertaking a forensic examination of a device(s) and/or network security breaches and cyber attacks.
On successful completion of this unit, students will be able to carry out digital forensics in accordance with industry and legal guidelines and procedures using different tools. They will also understand the low-level file structures of several OS and be able to undertake digital forensic investigation of devices. As a result, they will develop skills such as communication literacy, critical thinking, analysis, reasoning and interpretation, which are crucial for gaining employment and developing academic competence.
Learning Outcomes
By the end of this unit students will be able to:
LO1 Examine the processes and procedures for carrying out digital forensic investigation
LO2 Discuss the legal and professional guidelines and procedures for carrying out digital forensic investigation
LO3 Use a tool or tools to conduct digital forensic investigation on devices or networks or cyber attacks
LO4 Develop a forensic examination plan and make some recommendations for use in digital forensic investigation.
Essential Content
LO1 Examine the processes and procedures for carrying out digital forensic investigation
The process of carrying out digital forensic investigation:
Discuss what is meant by digital forensics.
Identify the processes and procedures for carrying out digital forensic investigation, including policy and procedure development, evidence assessment, evidence acquisition, evidence examination (including extraction and analysis).
Sources of information:
Log files, digital system monitors, access control logs, file/folder access logs, operational anomalies, current and future threats, newly identified vulnerabilities, manufacturer’s bulletins, hacker blogs and social media, collation of multiple sources to address and identify system security breach, root cause analysis.
LO2 Discuss the legal and professional guidelines and procedures for carrying out digital forensic investigation
Law enforcement:
Summarise APCO guidelines in relation to evidence collection, evidence preservation in a forensic investigation case. Discuss the activities of authorities, e.g. MI5/MI6, GCHQ and NSA, in relation to forensic investigations.
Legal and ethical considerations:
Discuss the following legal and ethical considerations when conducting a forensic investigation; Data Protection Act 2018; Computer Misuse Act 1990 and the Freedom of Information Act 2000.
Other stakeholders:
Forensic Science Society, BCS.
LO3 Use a tool or tools to conduct digital forensic investigation on devices or networks or cyber attacks
Tools required to conduct digital forensic investigation:
Hardware and software tools, e.g. Security Information and Event Management (SIEM) tools, system logs, penetration testing tools, network performance tools.
Conducting digital forensic investigation:
Conducting digital forensic investigation of devices, networks or cyber attacks to identify anomalies in observed digital system data structures, e.g. network packet data and digital system behaviours, including protocol behaviours, traffic levels and latency.
Identification and minimisation of false readings, e.g. negatives and positives generated by the available tools.
Examine Operating systems, e.g. MS-DOS, Windows, UNIX, Linux, MacOS, Android,.
LO4 Develop a forensic examination plan and make some recommendations for use in digital forensic investigation
Develop a forensic examination plan for digital devices or networks or cyber attacks:
Apply risk assessment and audit methodologies to identify potential vulnerabilities to inform a digital forensic examination plan.
Recommendations for improving system security based on identified vulnerabilities and potential emerging threats.
Explore current ‘best practice’ recommendations from professional and legal bodies for conducting digital forensic investigations and developing a forensic examination plan.
Learning Outcomes and Assessment Criteria
| Pass | Merit | Distinction |
| LO1 Examine the processes and procedures for carrying out digital forensic investigation |
D1 Evaluate the advantages and disadvantages of conducting digital forensic investigation to improve system security. |
|
| P1 Discuss what is meant by digital forensics with the aid of diagrams/ pictures.
P2 Examine the processes and procedures for conducting digital Forensic investigation. |
M1 Assess the importance of following a process or procedure when conducting digital forensic investigation. | |
| LO2 Discuss the legal and professional guidelines and procedures for carrying out digital forensic investigation |
D2 Evaluate the impact of both following and not following guidelines in a legal case, with regard to digital forensic evidence. |
|
| P3 Examine law enforcement guidelines for conducting digital forensic investigations.
P4 Discuss legal and ethical requirements for conducting digital forensic investigations. |
M2 Assess how ethical it is to conduct digital forensic investigation on a suspected individual, with reference to their legal rights. | |
| Pass | Merit | Distinction |
| LO3 Use a tool or tools to conduct digital forensic investigation on devices or networks or cyber attacks |
LO3 and LO4 |
|
| P5 Determine hardware and software tools that can be used to conduct digital forensic investigation.
P6 Examine the file system structure of several operating systems |
M3 Compare two tools that can be used to conduct digital forensic investigation.
M4 Conduct a digital forensic investigation on a device or network or cyber attack. |
D3 Critically evaluate the forensic investigation carried out, suggesting improvements to the current digital forensic investigation guidelines, processes and procedures. |
| LO4 Develop a forensic examination plan and make some recommendations for use in digital forensic investigation | ||
| P7 Develop a forensic examination plan for conducting an analysis on digital devices or networks or cyber attacks.
P8 Recommend improvements based on investigation analysis. |
M5 Compare the recommendations for best practices for conducting digital forensics.
|
|
Recommended Resources
Textbooks
Carrier. B. (2005) File System Forensic Analysis. Harlow: Addison-Wesley.
Farmer, D. and Venema, W. (2005) Forensic Discovery. Harlow: Addison-Wesley.
Hayes D. (2020) A Practical Guide to Digital Forensics Investigations. USA Pearson.
Jones, R. (2005) Internet Forensics. Sebastopol, O’Reilly.
Parasram, S. (2020) Digital Forensics with Kali Linux. 2nd edn. Packt Publishing
Sammes, A. and Jenkinson, B. (2007) Forensic Computing: A Practitioner’s Guide. 2nd edn. London, Springer.
Links
This unit links to the following related units:
Unit 30: Applied Cryptograpy in the Cloud
Unit 32: Information Security Management.
Are You Searching Answer of this Question? Request British Writers to Write a plagiarism Free Copy for You.
Chat Now