BTEC Level 5 Unit 31 Forensics (T/618/7444) Assignment Brief 2026

Unit 31 Forensics Assignment Brief 2026

Introduction

This unit introduces students to digital forensics involving the use of specialised techniques to investigate the recovery, authentication and analysis of data on electronic data storage devices, as well as network security breaches and cyber attacks, using different tools and techniques.

With the current widespread use of digital devices, digital forensics has become an important part of the detection of crime by being able to identify details of what has been stored on digital devices in the past. Students will have the opportunity to learn about some of the lower-level structures of data storage devices and the techniques used to investigate them.

Among the topics included in this unit are: describing the process of carrying out digital forensics; forensic investigation legal guidelines and procedures; understanding low-level file structures of several operating systems (OS); creating a book disk to enable forensic examination of devices and undertaking a forensic examination of a device(s) and/or network security breaches and cyber attacks.

On successful completion of this unit, students will be able to carry out digital forensics in accordance with industry and legal guidelines and procedures using different tools. They will also understand the low-level file structures of several OS and be able to undertake digital forensic investigation of devices. As a result, they will develop skills such as communication literacy, critical thinking, analysis, reasoning and interpretation, which are crucial for gaining employment and developing academic competence.

Learning Outcomes

By the end of this unit students will be able to:

LO1 Examine the processes and procedures for carrying out digital forensic investigation

LO2 Discuss the legal and professional guidelines and procedures for carrying out digital forensic investigation

LO3 Use a tool or tools to conduct digital forensic investigation on devices or networks or cyber attacks

LO4 Develop a forensic examination plan and make some recommendations for use in digital forensic investigation.

Essential Content

LO1 Examine the processes and procedures for carrying out digital forensic investigation

The process of carrying out digital forensic investigation:

Discuss what is meant by digital forensics.

Identify the processes and procedures for carrying out digital forensic investigation, including policy and procedure development, evidence assessment, evidence acquisition, evidence examination (including extraction and analysis).

Sources of information:

Log files, digital system monitors, access control logs, file/folder access logs, operational anomalies, current and future threats, newly identified vulnerabilities, manufacturer’s bulletins, hacker blogs and social media, collation of multiple sources to address and identify system security breach, root cause analysis.

LO2 Discuss the legal and professional guidelines and procedures for carrying out digital forensic investigation

Law enforcement:

Summarise APCO guidelines in relation to evidence collection, evidence preservation in a forensic investigation case. Discuss the activities of authorities, e.g. MI5/MI6, GCHQ and NSA, in relation to forensic investigations.

Legal and ethical considerations:

Discuss the following legal and ethical considerations when conducting a forensic investigation; Data Protection Act 2018; Computer Misuse Act 1990 and the Freedom of Information Act 2000.

Other stakeholders:

Forensic Science Society, BCS.

LO3 Use a tool or tools to conduct digital forensic investigation on devices or networks or cyber attacks

Tools required to conduct digital forensic investigation:

Hardware and software tools, e.g. Security Information and Event Management (SIEM) tools, system logs, penetration testing tools, network performance tools.

Conducting digital forensic investigation:

Conducting digital forensic investigation of devices, networks or cyber attacks to identify anomalies in observed digital system data structures, e.g. network packet data and digital system behaviours, including protocol behaviours, traffic levels and latency.

Identification and minimisation of false readings, e.g. negatives and positives generated by the available tools.

Examine Operating systems, e.g. MS-DOS, Windows, UNIX, Linux, MacOS, Android,.

LO4 Develop a forensic examination plan and make some recommendations for use in digital forensic investigation

Develop a forensic examination plan for digital devices or networks or cyber attacks:

Apply risk assessment and audit methodologies to identify potential vulnerabilities to inform a digital forensic examination plan.

Recommendations for improving system security based on identified vulnerabilities and potential emerging threats.

Explore current ‘best practice’ recommendations from professional and legal bodies for conducting digital forensic investigations and developing a forensic examination plan.

Learning Outcomes and Assessment Criteria

Recommended Resources

Textbooks

Carrier. B. (2005) File System Forensic Analysis. Harlow: Addison-Wesley.

Farmer, D. and Venema, W. (2005) Forensic Discovery. Harlow: Addison-Wesley.

Hayes D. (2020) A Practical Guide to Digital Forensics Investigations. USA Pearson.

Jones, R. (2005) Internet Forensics. Sebastopol, O’Reilly.

Parasram, S. (2020) Digital Forensics with Kali Linux. 2nd edn. Packt Publishing

Sammes, A. and Jenkinson, B. (2007) Forensic Computing: A Practitioner’s Guide. 2nd edn. London, Springer.

Links

This unit links to the following related units:

Unit 5: Security

Unit 30: Applied Cryptograpy in the Cloud

Unit 32: Information Security Management.

Answer

Request Answer of this Assignment