Business Academy Copenhagen (EK)

da

Digital Forensics

2026/2027
Danish title
Digital Forensics
Study programme
IT Security
Type of education
Full time education
Level of education
Bachelor (top-up)
Semester
2. semester
Duration of the subject/module
1 semester
Ects
10
Programme elements
Elective
Language
English
Start time
Autumn
Spring
Location
Guldbergsgade 29 N, København N
Subject number
4118222
Responsible for the subject(s)/modul(es)
Steven William Albury
  • Purpose and learning objectives

    The student is able to carry out a digital forensic investigation on one or more computers. Through the course, the student learns to understand and organize an investigation of evidence, as well as how the handling of sensitive personal data must be managed.

    Knowledge

    • The principles of digital forensics for Linux
    • Key digital forensics processes
    • Understanding of Linux artefacts
    • IT policies, ethics, and law
    • Understanding of discrete mathematics and algorithms in relation to forensics

    Skills

    • Conduct a digital forensic investigation on a Linux computer
    • Collect evidence from artefacts to a formal standard
    • Construct a timeline from digital evidence
    • Recover evidence using tools and scripting
    • Evaluate evidence and report findings accurately

    Competences

    • Search for information and compare artefacts across versions and variations
    • Handle fundamental tasks in a digital forensic investigation
    • Use a range of tools in a digital forensic investigation
    • Explain findings to non-technical audiences

  • Type of instruction
    Teaching in the Cybersecurity programme is conducted as a dynamic and interactive process, with a strong emphasis on active student participation. The teaching is based on relevant industry practices and combines practical experience with theoretical knowledge. Problems and cases from different types of companies within the IT industry are incorporated into the learning activities. Students are expected to take responsibility for their own learning, and both students and lecturers contribute constructively to the learning process.

    To ensure optimal academic learning and personal development for each student, the programme applies a varied pedagogical approach with emphasis on dialogue, discussion, and project-based learning.

    Teaching is organized through a variety of learning activities, including classroom teaching, guest lectures, company visits, group project work, and individual assignments — often involving interdisciplinary challenges and always with an application-oriented perspective. In addition to the academic content, these different learning methods help develop the students’ ability to work both independently and collaboratively.

    Common to all these activities is that EK consistently aims to establish clear objectives for the learning activities.
  • Exam

    The learning outcomes of the exam are identical with the learning outcomes of the subject(s)/modul(es)

    Prerequisites for access to the examination
    It is a prerequisite for being admitted to the exam that the student submits 2–4 written assignments, which must be approved before the student takes the exam for the first time.
    The assignments will be described during the semester.

    Failure to fulfill this prerequisite means that the student will have used one exam attempt.
    Exam in one or more subjects
    Subject/module is tested standalone
    Type of exam
    Oral examination
    30 minutes, including deliberation.
    The student starts with a 10 minutes presentation.
    Individual exam or group exam
    Individual
    Exam languages
    English
    Duration
    30 minutes, including deliberation.
    The student starts with a 10 minutes presentation.
    Type of evaluation
    7-point grading scale
    Examiners
    Internal censure
53
hours of teaching
221
hours of preparation
The figure shows the extent of workload related to the subject divided into different study activities.

In the subject Digital Forensics you will receive 53 hours of instruction, which corresponds to 70 lessons (1 lesson = 45 min.) and 19% of your total workload for the subject.

The teaching primarily consists of the following activities: classroom teaching, group work, exercises.
The preparation primarily consists of the following activities: group work, exercises.

Read about KEAs Study Activity Model

*KEA can deviate from the number of hours if this is justified by special circumstances