Florida Department of Education
Curriculum Framework 

Program Title:	Digital Forensics
Career Cluster:	Information Technology

CCC	
CIP Number	0511100119	
Program Type	College Credit Certificate (CCC)	
Program Length	32 credit hours	
CTSO	PBL, BPA 	
SOC Codes (all applicable) 	Assignment pending.	
CTE Program Resources 	http://www.fldoe.org/academics/career-adult-edu/career-tech-edu/program-resources.stml	

Purpose

This certificate program is part of the Network Systems Technology AS degree program (1511100112).

A College Credit Certificate consists of a program of instruction of less than sixty (60) credits of college-level courses, which is part of an AS or AAS degree program and prepares students for entry into employment (Rule 6A-14.030, F.A.C.).

This program offers a sequence of courses that provides coherent and rigorous content aligned with challenging academic standards and relevant technical knowledge and skills needed to prepare for further education and careers in the Information Technology career cluster; provides technical skill proficiency, and includes competency-based applied learning that contributes to the academic knowledge, higher-order reasoning and problem-solving skills, work attitudes, general employability skills, technical skills, and occupation-specific skills, and knowledge of all aspects of the Information Technology career cluster. 

The content includes but is not limited to instruction in computer literacy; software application support; basic hardware configuration and troubleshooting; networking technologies, troubleshooting, security, and administration; and customer service and human relations skills.

Additional Information relevant to this Career and Technical Education (CTE) program is provided at the end of this document.

Standards

After successfully completing this program, the student will be able to perform the following:

01.0	Demonstrate proficiency in basic and advanced security concepts.
02.0	Demonstrate proficiency in managing hardware involved in imaging and data collection activities.
03.0	Demonstrate proficiency in analyzing common file systems.
04.0	Demonstrate proficiency in performing computer forensics investigations.
05.0	Demonstrate proficiency in performing mobile device forensics.
06.0	Demonstrate proficiency in incident handling and response.
07.0	Identify key pieces of legislation and processes related to digital forensics.
08.0	Demonstrate an understanding of the tasks related to the casework process.

Florida Department of Education
Student Performance Standards

Program Title:	Digital Forensics
CIP Number:		0511100119
Program Length:	32 credit hours
SOC Code(s):		 

This certificate program is part of the Network Systems Technology AS degree program (1511100112).  At the completion of this program, the student will be able to:	
01.0	Demonstrate proficiency in basic and advanced security concepts.  The student will be able to:	
01.01	Demonstrate an understanding of cybersecurity, including its origins, trends, culture, and legal implications.	
01.02	Describe the basic categories of vulnerabilities associated with cybersecurity (i.e., hardware, software, network, human, physical, organizational).	
01.03	Describe the role of digital certificates and their role in IT security.	
01.04	Describe network-based IDS, its capabilities, and its approaches to detection (i.e., anomaly, signature).	
01.05	Describe the use of firewalls and other means of intrusion prevention.	
01.06	Describe security design principles and their role in limiting points of vulnerability.	
01.07	Discuss authentication methods and strategies.	
01.08	Describe the processes involved in hardening a computer system or network.	
01.09	Compare and contrast the forms, limitations, and vulnerabilities associated with centralized and decentralized key management schemas, including the PKI web of trust model.	
01.10	Evaluate an existing security posture and identify gaps and vulnerabilities in security.	
01.11	Describe the types of penetration tests (i.e., human, physical, wireless, data networks, telecommunications), the goals of each type, the metrics tested, and the value of their results.	
01.12	Compare and contrast the processes of black box versus white box penetration testing, including their characteristics, limitations, and appropriateness.	
01.13	Describe common testing methodologies and standards used in penetration testing.	
01.14	Demonstrate proficiency in basic forensic concepts.	
01.15	Describe the range of testing/evaluation and associated tools used to monitor mitigation control effectiveness.	
01.16	Create a risk management framework.	
01.17	Describe the purpose and scope of an Information Systems Contingency Plan (ISCP).	
01.18	Identify the five main components of a contingency plan (i.e., Supporting Information, Activation and Notification, Recovery, Reconstitution, and Appendices).	
01.19	Describe the purpose and scope of an IT security disaster recovery plan.	
01.20	Describe the purpose and scope of an IT security business continuity plan.	
01.21	Describe the four phases of forensic analysis and discuss the activities performed in each phase.	
01.22	Describe the forensic and evidentiary considerations when determining containment.	
01.23	Describe the types and sources of data collected for forensic analysis.	
01.24	Explain the various forms of data and associated collection/retrieval tools for the application transport, IP, and link layers.	
01.25	Describe the essential elements of forensic analysis.	
02.0	Demonstrate proficiency in managing hardware involved in imaging and data collection activities.  The student will be able to:	
02.01	Discuss the different types of Motherboard Connections.	
02.02	Explain the components that comprise a Motherboard and their functions.	
02.03	Describe the different types of permanent storage.	
02.04	Compare and contrast the different host interface standards.	
02.05	Describe how Solid State storage processes differ from traditional storage.	
02.06	Discuss the different types of removable media and their impacts on data collection.	
02.07	Explain the concepts of RAID including the different Levels and their impacts on the imaging and collection process.	
02.08	Compare and contrast the read/write process of both permanent and temporary storage devices.	
02.09	Compare the standard boot process to the Forensic/controlled boot process.	
03.0	Demonstrate proficiency in analyzing common file systems.  The student will be able to:	
03.01	Define the Master Boot Record (MBR) and discuss its purpose and any important items that it may contain.	
03.02	Explain the purpose of the Boot Parameter Block (BPB) and its components.	
03.03	Discuss the different File Systems available in an OS environment. Identify the strengths and weaknesses of each system.	
03.04	Explain the process of file creation and deletion in an OS environment including the concept of file artifacts.	
03.05	Discuss the formatting process in an OS environment.	
03.06	Explain pertinent OS system files related to data storage and their functions.	
03.07	Discuss how Windows handles the concept of Date and Time in relation to file management and how it differs from UNIX-like operating systems.	
03.08	Define the different file systems that can be used with removable media.	
03.09	Explain the concepts of Open and Closed sessions.	
04.0	Demonstrate proficiency in performing computer forensics investigations.  The student will be able to:	
04.01	Create security incident handling and response policies.	
04.02	Recover deleted, encrypted, or damaged file information as evidence for civil or criminal cases.	
04.03	Deploy proprietary and/or open source tools to identify an intruder’s footprints.	
04.04	Coordinate incident response activities in cooperation with law enforcement agencies.	
04.05	Prepare proper documentations of chain of custody, accounting for where each evidence item originated from, where it is going, and what entity has possession of the evidence.	
04.06	Preserve forensic integrity of evidence so they can be admissible in court.	
04.07	Describe moral and ethical standards in conducting digital forensics investigations.	
05.0	Demonstrate proficiency in performing mobile device forensics.  The student will be able to:	
05.01	Preserve, acquire, and examine data stored on mobile devices.	
05.02	Perform forensic acquisition and examination of SIM cards.	
05.03	Apply forensic principles and tools to mobile and IoT devices.	
05.04	Demonstrate proficiency in using open-source and proprietary mobile device forensics tools.	
05.05	Compare forensic acquisition tools and validate the completeness and accuracy of results.	
05.06	Describe forensic acquisition and examination of GPS navigation devices.	
05.07	Utilize the results from mobile device forensics for internal investigations or in civic/criminal litigation.	
06.0	Demonstrate proficiency in incident handling and response.  The student will be able to:	
06.01	Design an incident response plan including: assessment, communication, containment, evaluation, recovery, and documentation.	
06.02	Describe information-hiding techniques.	
06.03	Describe the steps required to collect, seize, and protect evidence.	
06.04	Recover data from various storage devices after physical and/or logical damage.	
06.05	Search and report on memory in real time with live and system forensics.	
06.06	Investigate network traffic using log files, time analysis, sniffers, and other traffic analysis tools.	
06.07	Explain the legal considerations to investigating emails as prescribed in the Electronic Communications Privacy Act.	
06.08	Identify email tracing techniques in forensic investigations.	
07.0	Identify key pieces of legislation and processes related to digital forensics.  The student will be able to:	
07.01	Describe the importance of creating an accurate representation of the facts.	
07.02	Explain the components of the Discovery Process.	
07.03	Discuss the 4th Amendment and its impact on the digital forensics investigative process.	
07.04	Identify laws and court cases related to computer forensics and their impacts on the investigation process.	
07.05	Identify and explain the basic Federal Rules of Evidence.	
07.06	Compare and contrast the different qualifications required to be a licensed computer forensics professional from state to state.	
07.07	Define the concept of a subpoena and explain the process of how one is obtained.	
07.08	Explain the steps required to acquire a search warrant.	
07.09	Discuss the concept of consent and the ways that it can be granted.	
07.10	Compare the legal process for civil and criminal cases.	
07.11	Define the concept of expert testimony and the process involved in being classified as an expert.	
07.12	Discuss appropriate courtroom behavior.	
08.0	Demonstrate an understanding of the tasks related to the casework process.  The student will be able to:	
08.01	Explain the steps involved in maintaining the integrity of digital evidence.	
08.02	Discuss the process of creating a forensics image.	
08.03	Define hashing and explain its uses in ensuring image authenticity.	
08.04	Describe sector slack space and its potential impact on evidence gathering.	
08.05	Describe the importance of documenting the examination process.	
08.06	Explain control/security access logs for images and their importance in maintaining evidence.	
08.07	Describe the steps involved in preparing evidence and documents for trial.	
08.08	Explain the procedures involved in creating a digital forensics investigation report including examples of report formats.	
08.09	Discuss the importance of the Summation and Analysis sections of the digital investigation report.	

Additional Information

Laboratory Activities

Laboratory investigations that include scientific inquiry, research, measurement, problem solving, emerging technologies, tools and equipment, as well as, experimental, quality, and safety procedures are an integral part of this career and technical program/course. Laboratory investigations benefit all students by developing an understanding of the complexity and ambiguity of empirical work, as well as the skills required to manage, operate, calibrate and troubleshoot equipment/tools used to make observations. Students understand measurement error; and have the skills to aggregate, interpret, and present the resulting data. Equipment and supplies should be provided to enhance hands-on experiences for students.

Career and Technical Student Organization (CTSO)

Phi Beta Lambda (PBL) and Business Professionals of America (BPA) are the intercurricular career and technical student organizations providing leadership training and reinforcing specific career and technical skills.  Career and Technical Student Organizations provide activities for students as an integral part of the instruction offered.  

Accommodations

Federal and state legislation requires the provision of accommodations for students with disabilities to meet individual needs and ensure equal access. Postsecondary students with disabilities must self-identify, present documentation, request accommodations if needed, and develop a plan with their counselor and/or instructors. Accommodations received in postsecondary education may differ from those received in secondary education. Accommodations change the way the student is instructed. Students with disabilities may need accommodations in such areas as instructional methods and materials, assignments and assessments, time demands and schedules, learning environment, assistive technology and special communication systems. Documentation of the accommodations requested and provided should be maintained in a confidential file.

Additional Resources

For additional information regarding articulation agreements, Bright Futures Scholarships, Fine Arts/Practical Arts Credit and Equivalent Mathematics and Equally Rigorous Science Courses please refer to:
http://www.fldoe.org/academics/career-adult-edu/career-tech-edu/program-resources.stml