2016 – 2017
Florida Department of Education
Curriculum Framework 

Program Title:	Digital Forensics
Career Cluster:	Information Technology

CCC	
CIP Number	0511100119	
Program Type	College Credit Certificate (CCC)	
Program Length	Primary:  32 credit hours; Secondary:  24 credit hours	
CTSO	Phi Beta Lambda, BPA 	
SOC Codes (all applicable) 	15-1122 – Information Security Analysts	
CTE Program Resources 	http://www.fldoe.org/academics/career-adult-edu/career-tech-edu/program-resources.stml	

Purpose

This certificate program is part of the Network Systems Technology AS degree program (1511100112).

A College Credit Certificate consists of a program of instruction of less than sixty (60) credits of college-level courses, which is part of an AS or AAS degree program and prepares students for entry into employment (Rule 6A-14.030, F.A.C.).

This program offers a sequence of courses that provides coherent and rigorous content aligned with challenging academic standards and relevant technical knowledge and skills needed to prepare for further education and careers in the Information Technology career cluster; provides technical skill proficiency, and includes competency-based applied learning that contributes to the academic knowledge, higher-order reasoning and problem-solving skills, work attitudes, general employability skills, technical skills, and occupation-specific skills, and knowledge of all aspects of the Information Technology career cluster. 

The content includes but is not limited to instruction in computer literacy; software application support; basic hardware configuration and troubleshooting; networking technologies, troubleshooting, security, and administration; and customer service and human relations skills.

Additional Information relevant to this Career and Technical Education (CTE) program is provided at the end of this document.

Standards

After successfully completing this program, the student will be able to perform the following:

01.0	Demonstrate proficiency in basic and advanced security concepts.
02.0	Demonstrate proficiency in managing hardware involved in imaging and data collection activities.
03.0	Demonstrate proficiency in analyzing common file systems.
04.0	Demonstrate proficiency in performing computer forensics investigations.
05.0	Demonstrate proficiency in performing mobile device forensics.
06.0	Demonstrate proficiency in incident handling and response.
07.0	Identify key pieces of legislation and processes related to digital forensics.
08.0	Understand the tasks related to the casework process.

2016 – 2017
Florida Department of Education
Student Performance Standards

Program Title:	Digital Forensics
CIP Number:		0511100119
Program Length:	Primary:  32 credit hours; Secondary:  24 credit hours
SOC Code(s):		15-1122 

This certificate program is part of the Network Systems Technology AS degree program (1511100112).  At the completion of this program, the student will be able to:	
01.0	Demonstrate proficiency in basic and advanced security concepts. – The student will be able to:	
01.01	Demonstrate an understanding of cybersecurity, including its origins, trends, culture, and legal implications.	
01.02	Describe the basic categories of vulnerabilities associated with cybersecurity (i.e., hardware, software, network, human, physical, organizational).	
01.03	Describe the role of certificates and their role in cybersecurity.	
01.04	Describe network-based IDS, its capabilities, and its approaches to detection (i.e., anomaly, signature).	
01.05	Describe the use of firewalls and other means of intrusion prevention.	
01.06	Describe security design principles and their role in limiting points of vulnerability.	
01.07	Discuss authentication methods and strategies.	
01.08	Describe the processes involved in hardening a computer system or network.	
01.09	Compare and contrast the forms, limitations, and vulnerabilities associated with centralized and decentralized key management schemas, including the PKI web of trust model.	
01.10	Evaluate an existing security posture and identify gaps and vulnerabilities in security.	
01.11	Describe the types of penetration tests (i.e., human, physical, wireless, data networks, telecommunications), the goals of each type, the metrics tested, and the value of their results.	
01.12	Compare and contrast the processes of black box versus white box penetration testing, including their characteristics, limitations, and appropriateness.	
01.13	Describe common testing methodologies and standards used in penetration testing.	
01.14	Describe the activities that make up the Preparation Phase of the Incident Response Life Cycle, including identification of useful tools and resources.	
01.15	Describe the range of testing/evaluation and associated tools used to monitor mitigation control effectiveness.	
01.16	Create a risk management framework.	
01.17	Describe the purpose and scope of an Information Systems Contingency Plan (ISCP).	
01.18	Identify the five main components of a contingency plan (i.e., Supporting Information, Activation and Notification, Recovery, Reconstitution, Appendices).	
01.19	Describe the purpose and scope of a cybersecurity disaster recovery plan.	
01.20	Describe the purpose and scope of a cybersecurity business continuity plan.	
01.21	Describe the four phases of forensic analysis and discuss the activities performed in each phase.	
01.22	Describe the forensic and evidentiary considerations when determining containment.	
01.23	Describe the types and sources of data collected for forensic analysis.	
01.24	Explain the various forms of data and associated collection/retrieval tools for the application transport, IP, and link layers.	
01.25	Describe the essential elements of forensic analysis.	
02.0	Demonstrate proficiency in managing hardware involved in imaging and data collection activities. – The student will be able to:	
02.01	Motherboard Connections.	
02.02	Motherboard components and functions.	
02.03	Optical drives.	
02.04	Hard drives.	
02.05	IDE.	
02.06	EIDE/PATA.	
02.07	SCSI.	
02.08	SATA.	
02.09	Esata.	
02.10	Solid State drives.	
02.11	Other removable media.	
02.12	RAID Connections and Issues.	
02.13	Types of connectors and connections.	
02.14	General personal computer processes.	
02.15	Boot process.	
02.16	Forensic/controlled boot process.	
03.0	Demonstrate proficiency in analyzing common file systems. – The student will be able to:	
03.01	Master Boot Record.	
03.02	Boot Parameter Block (BPB) components.	
03.03	Format Process:  FAT 16 and FAT 32.	
03.04	File creation and deletion processes and artifacts.	
03.05	Pertinent operating system files including WIN386.SWP.	
03.06	NTFS.	
03.06.1	File creation and deletion processes and artifacts.	
03.06.2	Pertinent operating system files including the MFT and Pagefile.	
03.06.3	Registry.	
03.06.4	Understand basics of registry and components.	
03.06.5	Dates and Times.	
03.07	MFT.	
03.07.1	File storage mechanisms.	
03.07.2	Date and Time.	
03.08	EXT2, EXT3, and EXT4.	
03.09	Optical media.	
03.09.1	General Formats and Types.	
03.09.2	Open and closed sessions.	
04.0	Demonstrate proficiency in performing computer forensics investigations. – The student will be able to:	
04.01	Create security incident handling and response policies.	
04.02	Recover deleted, encrypted, or damaged file information as evidence for prosecution in computer crimes such as industrial espionage, E-mail fraud, and possession of pornography.	
04.03	Deploy proprietary and/or open source tools to identify an intruder’s footprints.	
04.04	Coordinate incident response activities in cooperation with law enforcement agencies.	
04.05	Prepare proper documentations of chain of custody, accounting for where each evidence item originated from, where it is going, and what entity has possession of the evidence.	
04.06	Preserve forensic integrity of evidence so they can be admissible in court.	
04.07	Model highest moral and ethical standards in conducting digital forensics investigations.	
05.0	Demonstrate proficiency in performing mobile device forensics. – The student will be able to:	
05.01	Preserve, acquire, and examine data stored on mobile devices.	
05.02	Perform forensic acquisition and examination of SIM cards.	
05.03	Apply forensic principles and tools to some of the most popular smart phones.	
05.04	Demonstrate proficiency in using open-source and proprietary mobile device forensics tools.	
05.05	Compare forensic acquisition tools and validate the completeness and accuracy of results.	
05.06	Model forensic acquisition and examination of GPS navigation devices.	
05.07	Utilize the results from mobile device forensics for internal investigations or in civic/criminal litigation.	
06.0	Demonstrate proficiency in incident handling and response. – The student will be able to:	
06.01	Design an incident response plan including: assessment, communication, containment, evaluation, recovery, and documentation.	
06.02	Model information-hiding techniques.	
06.03	Collect, seize, and protect evidence.	
06.04	Recover data from various storage devices after physical and/or logical damage.	
06.05	Search memory in real time with live and system forensics.	
06.06	Investigate network traffic using log files, time analysis, sniffers, and other traffic analysis tools.	
06.07	Explain the legal considerations to investigating E-mails as prescribed in the Electronic Communications Privacy Act.	
06.08	Model E-mail tracing techniques in forensic investigations.	
07.0	Identify key pieces of legislation and processes related to digital forensics. – The student will be able to:	
07.01	Representation of facts.	
07.02	Components of the Discovery Process.	
07.03	The 4th Amendment.	
07.04	Electronic Communications Privacy Act.	
07.05	Privacy Protection Act.	
07.06	Digital Millennium Copyright Act.	
07.07	18 USC 2703(d).	
07.08	Federal Rules of Evidence (basics).	
07.09	Review state to state licensing requirements for computer forensic professionals.	
07.10	Subpoenas.	
07.11	Search warrant.	
07.12	Consent.	
07.13	Legal process for civil and criminal cases.	
07.14	Expert Testimony and process.	
07.15	Daubert and Frye cases.	
07.16	Courtroom behavior.	
08.0	Understand the tasks related to the casework process. – The student will be able to:	
08.01	Maintain evidence integrity.	
08.02	Image evidence.	
08.03	Ensure evidence image authenticity via hashing.	
08.04	Sector slack space.	
08.05	Text gathering.	
08.06	Prepare examination media.	
08.07	Process forensic image.	
08.08	Document examination process.	
08.09	Control/security and access logs for image media.	
08.10	Disposition of evidence.	
08.11	Prepare documents for trial.	
08.12	Summation and Analysis sections.	
08.13	Format examples.	
08.14	Appendices and Glossaries.	
08.15	Report preparation.	

Additional Information

Laboratory Activities

Laboratory investigations that include scientific inquiry, research, measurement, problem solving, emerging technologies, tools and equipment, as well as, experimental, quality, and safety procedures are an integral part of this career and technical program/course. Laboratory investigations benefit all students by developing an understanding of the complexity and ambiguity of empirical work, as well as the skills required to manage, operate, calibrate and troubleshoot equipment/tools used to make observations. Students understand measurement error; and have the skills to aggregate, interpret, and present the resulting data. Equipment and supplies should be provided to enhance hands-on experiences for students.

Career and Technical Student Organization (CTSO)

Phi Beta Lambda and Business Professionals of America (BPA) are the intercurricular career and technical student organizations providing leadership training and reinforcing specific career and technical skills.  Career and Technical Student Organizations provide activities for students as an integral part of the instruction offered.  

Accommodations

Federal and state legislation requires the provision of accommodations for students with disabilities to meet individual needs and ensure equal access. Postsecondary students with disabilities must self-identify, present documentation, request accommodations if needed, and develop a plan with their counselor and/or instructors. Accommodations received in postsecondary education may differ from those received in secondary education. Accommodations change the way the student is instructed. Students with disabilities may need accommodations in such areas as instructional methods and materials, assignments and assessments, time demands and schedules, learning environment, assistive technology and special communication systems. Documentation of the accommodations requested and provided should be maintained in a confidential file.

Additional Resources

For additional information regarding articulation agreements, Bright Futures Scholarships, Fine Arts/Practical Arts Credit and Equivalent Mathematics and Equally Rigorous Science Courses please refer to:
http://www.fldoe.org/academics/career-adult-edu/career-tech-edu/program-resources.stml