CS499 Special Topics in Computer Science II
Syllabus | International University of Sarajevo - Last Update on Sep 09, 2026
Syllabus Quick Jump
Search and navigate to any syllabus instantly
Computer Sciences and Engineering
Amal Mersni
Course Lecturer
Course Objectives
The aim of this course is to give students a working command of digital forensic investigation, from the seizure of evidence to the presentation of findings before a court. Students learn the legal and ethical framework within which forensic work is carried out, the procedures for securing a scene and maintaining chain of custody, and the methods used to acquire evidence without altering it. They then examine evidence from a range of sources: file systems and their internals, Windows and Unix operating system artifacts, volatile memory, network traffic, mobile devices and cloud services, learning to reconstruct a sequence of events and to recognise attempts to conceal activity. The course is taught mainly through laboratory work, using open source forensic tools on publicly available evidence images. In the second part of the semester students work in teams on a single case, which they report on in writing and defend orally in the final week.
Learning Outcomes
After successful completion of the course, the student will be able to:
Course Materials
Required Textbook
-
Nelson, B., Phillips, A., Steuart, C., & Hua, J. (2025). Guide to computer forensics and investigations (7th ed.). Cengage Learning.
Additional Literature
1. Association of Chief Police Officers. (2012). ACPO good practice guide for digital evidence (Version 5). 2. Ayers, R., Brothers, S., & Jansen, W. (2014). Guidelines on mobile device forensics (NIST Special Publication 800-101, Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-101r1 3. Carrier, B. (2005). File system forensic analysis. Addison-Wesley. 4. Council of Europe. (2001). Convention on cybercrime (European Treaty Series No. 185). 5. European Union Agency for Network and Information Security. (2014). Electronic evidence: A basic guide for first responders. ENISA. 6. Garfinkel, S., Farrell, P., Roussev, V., & Dinolt, G. (2009). Bringing science to digital forensics with standardized forensic corpora. Digital Investigation, 6(Suppl.), S2–S11. https://doi.org/10.1016/j.diin.2009.06.016 7. International Organization for Standardization. (2012). Information technology. Security techniques. Guidelines for identification, collection, acquisition and preservation of digital evidence (ISO/IEC 27037:2012). 8. International Organization for Standardization. (2015). Information technology. Security techniques (ISO/IEC 27041:2015, ISO/IEC 27042:2015 and ISO/IEC 27043:2015). 9. Ligh, M. H., Case, A., Levy, J., & Walters, A. (2014). The art of memory forensics: Detecting malware and threats in Windows, Linux, and Mac memory. Wiley. 10. Resnick, P. (Ed.). (2008). Internet message format (RFC 5322). Internet Engineering Task Force. https://doi.org/10.17487/RFC5322Teaching Methods
Each session combines a short lecture introducing the topic with laboratory work on evidence images
Students work individually during the first half of the semester and in teams on a common case from Week 9 onwards
Feedback is given on the weekly laboratory deliverable and on the developing case file
All software used in the course is free or open source, and a pre-built analysis virtual machine is provided in the first week
The laboratory sessions draw on Autopsy and The Sleuth Kit, FTK Imager, Eric Zimmerman's tools, KAPE, RegRipper, Volatility 3, Wireshark, Zeek, ALEAPP and iLEAPP, PhotoRec, Plaso and Timesketch, with evidence images taken from NIST CFReDS and Digital Corpora
Documentation for these tools, together with the SANS Windows forensic analysis poster, the Apple file system reference and the Microsoft and Amazon cloud audit documentation, is provided with the weekly handouts
Weekly Topics
| Week | Topic | Readings / References |
|---|---|---|
| 1 | Investigation process, ethics, legal framework and the forensic laboratory. Laboratory: building and validating the forensic workstation. | Ch. 1, 3, Appendix C; Budapest Convention; ISO/IEC 27037 |
| 2 | Processing crime and incident scenes, chain of custody, forensic report writing. Laboratory: staged scene, custody documentation, first report. | Ch. 5; Ch. 2 (reporting); ACPO Good Practice Guide |
| 3 | Data acquisition, write blocking and verification. Laboratory: imaging in raw and E01 formats, hash verification, network acquisition. | Ch. 4; NIST CFTT test reports |
| 4 | File systems and NTFS internals. Laboratory: manual parsing of partition structures and MFT records, recovery of deleted files. | Ch. 6, Appendix D; Carrier (2005), chapters on NTFS |
| 5 📍 | The Windows Registry. Laboratory: reconstruction of USB history, user accounts and program execution from Registry hives. | Ch. 6 (Registry); RegRipper documentation |
| 6 | Windows artifact analysis. Laboratory: triage of an image and reconstruction of user activity. | SANS Windows Forensic Analysis poster; KAPE and Zimmerman tool documentation |
| 7 | Linux and Macintosh file systems. Laboratory: analysis of a compromised ext4 image; macOS artifacts. | Ch. 7; Apple APFS reference |
| 8 | Midterm Exam | No classes |
| 9 | Memory forensics and live acquisition. Laboratory: memory capture and analysis with Volatility 3. Course project begins. | Ch. 9 (live acquisition); Volatility 3 documentation; Ligh et al. (2014) |
| 10 | Network forensics. Laboratory: reconstruction of an intrusion from captured traffic. | Ch. 10; Zeek and Wireshark documentation |
| 11 | Virtual machine and cloud forensics. Laboratory: analysis of virtual disks and snapshots, and of cloud audit logs. | Ch. 9 (virtual machines), Ch. 14; Microsoft Purview and AWS CloudTrail documentation |
| 12 | Mobile device and IoT forensics. Laboratory: examination of Android and iOS reference images. | Ch. 11, 12; Ayers et al. (2014), NIST SP 800-101 Rev. 1 |
| 13 | Media files, email and social media investigations. Laboratory: file carving, header repair, EXIF analysis and mailbox examination. | Ch. 8, 13; PhotoRec documentation; RFC 5322 |
| 14 | Timeline analysis and anti-forensics. Laboratory: combined timeline construction, detection of timestamp manipulation and wiping. | Plaso and Timesketch documentation |
| 15 | Expert testimony and e-Discovery. Project presentations and defence. | Ch. 2 (testimony), Ch. 15, 16; Appendix A |
Course Schedule (All Sections)
| Section | Type | Day 1 | Venue 1 | Day 2 | Venue 2 |
|---|---|---|---|---|---|
| CS499.1 | Course | Wednesday 15:00 - 17:50 | A F1.26 | - | - |
Office Hours & Room
Assessment Methods and Criteria
Assessment Components
Final Exam
AI: Not AllowedAlignment with Learning Outcomes : 1 2 3 4 5
Midterm exam
AI: Not AllowedAlignment with Learning Outcomes : 2 3 4 5
Hands-on Labs
AI: Not AllowedAlignment with Learning Outcomes : 2 3 4
Course project report
AI: Not AllowedAlignment with Learning Outcomes : 3 4 5
Project presentation and defence
AI: Not AllowedAlignment with Learning Outcomes : 4 5
IUS Grading System
| Grading Scale | IUS Grading System | IUS Coeff. | Letter (B&H) | Numerical (B&H) |
|---|---|---|---|---|
| 0 - 44 | F | 0 | F | 5 |
| 45 - 54 | E | 1 | ||
| 55 - 64 | C | 2 | E | 6 |
| 65 - 69 | C+ | 2.3 | D | 7 |
| 70 -74 | B- | 2.7 | ||
| 75 - 79 | B | 3 | C | 8 |
| 80 - 84 | B+ | 3.3 | ||
| 85 - 94 | A- | 3.7 | B | 9 |
| 95 - 100 | A | 4 | A | 10 |
Late Work Policy
Information about late submission policies will be shared during class and posted in this section. Please check back for official guidelines.
ECTS Credit Calculation
📚 Student Workload
This 6 ECTS credit course corresponds to 150 hours of total student workload, distributed as follows:
Lecture hours
28 hours ⏳ (14 week × 2 h)
Hand-on labs (in class)
14 hours ⏳ (14 week × 1 h)
Hand-on labs preparation and completion outside class
42 hours ⏳ (14 week × 3 h)
Course project
12 hours ⏳ (6 week × 2 h)
Reading and home study
18 hours ⏳ (9 week × 2 h)
Midterm exam preparation
16 hours ⏳ (4 week × 4 h)
Final exam preparation
20 hours ⏳ (4 week × 5 h)
150 Total Workload Hours
6 ECTS Credits
Course Policies
Academic Integrity
All work submitted must be your own. Plagiarism, cheating, or any form of academic dishonesty will result in disciplinary action according to university policies. When in doubt about citation practices, consult the instructor.
Attendance Policy
Students are expected to adhere to the attendance requirements as outlined in the International University of Sarajevo Study Rules and Regulations. Excessive absences, whether excused or unexcused, may impact academic performance and eligibility for assessment. Mandatory sessions (e.g., labs, workshops) require attendance unless formally exempted. For detailed policies on absences, documentation, and penalties, please refer to the official university regulations.
Technology & AI Policy
Laptops/tablets may be used for note-taking only during lectures. Phones should be silenced and put away during all class sessions. Audio/video recording requires prior permission from the instructor.
Artificial Intelligence (AI) Usage: The use of AI tools (e.g., ChatGPT, Copilot, Gemini) varies by assessment component. Please refer to the AI usage indicator next to each assessment item in the Assessment Methods and Criteria section above. Submitting AI-generated content as your own work, where AI is not explicitly allowed, constitutes an academic integrity violation.
Communication Policy
All course-related communication should occur through official university channels (institutional email or SIS). Emails should include [CS499] in the subject line.
Academic Quality Assurance Policy
Course Academic Quality Assurance is achieved through Semester Student Survey. At the end of each academic year, the institution of higher education is obliged to evaluate work of the academic staff, or the success of realization of the curricula.
Learning Tips
Be prepared to contribute thoughtfully during class discussions, labs, or collaborative work. Active participation deepens understanding and encourages critical thinking.
Complete assigned readings or prep materials before class. Take notes, highlight key ideas, and jot down questions. Aim to grasp core concepts and their applications—not just facts.
Use course frameworks or methodologies to analyze problems, case studies, or projects. Begin early to allow time for reflection and refinement. Seek feedback to improve your work.
Don’t hesitate to reach out when something is unclear. Use office hours, discussion boards, or peer networks to clarify concepts and stay on track.
Syllabus Last Updated on Sep 09, 2026 | International University of Sarajevo
Print Syllabus
Referencing Curricula Print this page
| Course Code | Course Title | Weekly Hours* | ECTS | Weekly Class Schedule | ||||||
| T | P | |||||||||
| CS499 | Special Topics in Computer Science II | 3 | 0 | 6 | ||||||
| Prerequisite | None | It is a prerequisite to | - | |||||||
| Lecturer | Amal Mersni | Office Hours / Room / Phone |
A F1.6
|
|||||||
| amersni@ius.edu.ba | ||||||||||
| Assistant | - | Assistant E-mail | ||||||||
| Course Objectives | The aim of this course is to give students a working command of digital forensic investigation, from the seizure of evidence to the presentation of findings before a court. Students learn the legal and ethical framework within which forensic work is carried out, the procedures for securing a scene and maintaining chain of custody, and the methods used to acquire evidence without altering it. They then examine evidence from a range of sources: file systems and their internals, Windows and Unix operating system artifacts, volatile memory, network traffic, mobile devices and cloud services, learning to reconstruct a sequence of events and to recognise attempts to conceal activity. The course is taught mainly through laboratory work, using open source forensic tools on publicly available evidence images. In the second part of the semester students work in teams on a single case, which they report on in writing and defend orally in the final week. |
|||||||||
| Textbook | Nelson, B., Phillips, A., Steuart, C., & Hua, J. (2025). Guide to computer forensics and investigations (7th ed.). Cengage Learning. | |||||||||
| Additional Literature |
|
|||||||||
| Learning Outcomes | After successful completion of the course, the student will be able to: | |||||||||
|
||||||||||
| Teaching Methods | Each session combines a short lecture introducing the topic with laboratory work on evidence images. Students work individually during the first half of the semester and in teams on a common case from Week 9 onwards. Feedback is given on the weekly laboratory deliverable and on the developing case file. All software used in the course is free or open source, and a pre-built analysis virtual machine is provided in the first week. The laboratory sessions draw on Autopsy and The Sleuth Kit, FTK Imager, Eric Zimmerman's tools, KAPE, RegRipper, Volatility 3, Wireshark, Zeek, ALEAPP and iLEAPP, PhotoRec, Plaso and Timesketch, with evidence images taken from NIST CFReDS and Digital Corpora. Documentation for these tools, together with the SANS Windows forensic analysis poster, the Apple file system reference and the Microsoft and Amazon cloud audit documentation, is provided with the weekly handouts. | |||||||||
| Teaching Method Delivery | Face-to-face | Teaching Method Delivery Notes | ||||||||
| WEEK | TOPIC | REFERENCE | ||||||||
| Week 1 | Investigation process, ethics, legal framework and the forensic laboratory. Laboratory: building and validating the forensic workstation. | Ch. 1, 3, Appendix C; Budapest Convention; ISO/IEC 27037 | ||||||||
| Week 2 | Processing crime and incident scenes, chain of custody, forensic report writing. Laboratory: staged scene, custody documentation, first report. | Ch. 5; Ch. 2 (reporting); ACPO Good Practice Guide | ||||||||
| Week 3 | Data acquisition, write blocking and verification. Laboratory: imaging in raw and E01 formats, hash verification, network acquisition. | Ch. 4; NIST CFTT test reports | ||||||||
| Week 4 | File systems and NTFS internals. Laboratory: manual parsing of partition structures and MFT records, recovery of deleted files. | Ch. 6, Appendix D; Carrier (2005), chapters on NTFS | ||||||||
| Week 5 | The Windows Registry. Laboratory: reconstruction of USB history, user accounts and program execution from Registry hives. | Ch. 6 (Registry); RegRipper documentation | ||||||||
| Week 6 | Windows artifact analysis. Laboratory: triage of an image and reconstruction of user activity. | SANS Windows Forensic Analysis poster; KAPE and Zimmerman tool documentation | ||||||||
| Week 7 | Linux and Macintosh file systems. Laboratory: analysis of a compromised ext4 image; macOS artifacts. | Ch. 7; Apple APFS reference | ||||||||
| Week 8 | Midterm Exam | No classes | ||||||||
| Week 9 | Memory forensics and live acquisition. Laboratory: memory capture and analysis with Volatility 3. Course project begins. | Ch. 9 (live acquisition); Volatility 3 documentation; Ligh et al. (2014) | ||||||||
| Week 10 | Network forensics. Laboratory: reconstruction of an intrusion from captured traffic. | Ch. 10; Zeek and Wireshark documentation | ||||||||
| Week 11 | Virtual machine and cloud forensics. Laboratory: analysis of virtual disks and snapshots, and of cloud audit logs. | Ch. 9 (virtual machines), Ch. 14; Microsoft Purview and AWS CloudTrail documentation | ||||||||
| Week 12 | Mobile device and IoT forensics. Laboratory: examination of Android and iOS reference images. | Ch. 11, 12; Ayers et al. (2014), NIST SP 800-101 Rev. 1 | ||||||||
| Week 13 | Media files, email and social media investigations. Laboratory: file carving, header repair, EXIF analysis and mailbox examination. | Ch. 8, 13; PhotoRec documentation; RFC 5322 | ||||||||
| Week 14 | Timeline analysis and anti-forensics. Laboratory: combined timeline construction, detection of timestamp manipulation and wiping. | Plaso and Timesketch documentation | ||||||||
| Week 15 | Expert testimony and e-Discovery. Project presentations and defence. | Ch. 2 (testimony), Ch. 15, 16; Appendix A | ||||||||
| Assessment Methods and Criteria | Evaluation Tool | Quantity | Weight | Alignment with LOs | AI Usage |
| Final Exam | 1 | 30 | 1,2,3,4,5 | Not Allowed | |
| Semester Evaluation Components | |||||
| Midterm exam | 1 | 25 | 2,3,4,5 | Not Allowed | |
| Hands-on Labs | 13 | 25 | 2,3,4 | Not Allowed | |
| Course project report | 1 | 15 | 3,4,5 | Not Allowed | |
| Project presentation and defence | 1 | 5 | 4,5 | Not Allowed | |
| *** ECTS Credit Calculation *** | |||||
| Activity | Hours | Weeks | Student Workload Hours | Activity | Hours | Weeks | Student Workload Hours | |||
| Lecture hours | 2 | 14 | 28 | Hand-on labs (in class) | 1 | 14 | 14 | |||
| Hand-on labs preparation and completion outside class | 3 | 14 | 42 | Course project | 2 | 6 | 12 | |||
| Reading and home study | 2 | 9 | 18 | Midterm exam preparation | 4 | 4 | 16 | |||
| Final exam preparation | 5 | 4 | 20 | |||||||
| Total Workload Hours = | 150 | |||||||||
| *T= Teaching, P= Practice | ECTS Credit = | 6 | ||||||||
| Course Academic Quality Assurance: Semester Student Survey | Last Update Date: 28/09/2026 | |||||||||