CS 585-002: Final Exam Study Guide

Format

The exam will consist of 10 open-response questions.

Coverage

Anything covered since the beginning of the course is fair game. About half the questions will deal with legal/procedural/context topics, and about half with technical topics. You are responsible for anything covered on any assignment, the midterm, the readings in the textbook, and the slides on the web.

Study Guide

Here are some concrete suggestions for topics to study:

You should be familiar with the relevant laws regarding collection and use of digital evidence. This includes especially the fourth amendment, what it requires, and the court-recognized exceptions, as well as ECPA and the Pen-Trap statute. (See Textbook chapters 3 and 7, and the lecture slides "Processing Digital Evidence: From the Crime Scene to the Courtroom".)
You should know the cases we discussed in class (BALCO, HP, credit card thieves), and be able to discuss their implications, if any.
You should know all the various places where data can be hidden in a file system. (See Chapter 8 and the lecture on Storage).
You should understand the concept of chain of custody, and techniques for maintaining it.
You should understand the process of collecting and analyzing digital evidence (see the slides "Processing Digital Evidence"), and its importance.
Look over the midterm exam, and especially review any question that you didn't do well on.
Know the kinds of tools that are useful in digital forensic investigation and analysis, and what each is good for.

Finally, the course learning outcomes (listed in the course syllabus) are a general guide to what you should know at the conclusion of the course.

Questions? Send email to the instructor (calvert@netlab.uky.edu).