Digital Forensics
2026/2027- Purpose and learning objectives
The student is able to carry out a digital forensic investigation on one or more computers. Through the course, the student learns to understand and organize an investigation of evidence, as well as how the handling of sensitive personal data must be managed.
Knowledge• The principles of digital forensics for Linux
Skills
• Key digital forensics processes
• Understanding of Linux artefacts
• IT policies, ethics, and law
• Understanding of discrete mathematics and algorithms in relation to forensics• Conduct a digital forensic investigation on a Linux computer
Competences
• Collect evidence from artefacts to a formal standard
• Construct a timeline from digital evidence
• Recover evidence using tools and scripting
• Evaluate evidence and report findings accurately• Search for information and compare artefacts across versions and variations
• Handle fundamental tasks in a digital forensic investigation
• Use a range of tools in a digital forensic investigation
• Explain findings to non-technical audiences - Type of instruction
Teaching in the Cybersecurity programme is conducted as a dynamic and interactive process, with a strong emphasis on active student participation. The teaching is based on relevant industry practices and combines practical experience with theoretical knowledge. Problems and cases from different types of companies within the IT industry are incorporated into the learning activities. Students are expected to take responsibility for their own learning, and both students and lecturers contribute constructively to the learning process.
To ensure optimal academic learning and personal development for each student, the programme applies a varied pedagogical approach with emphasis on dialogue, discussion, and project-based learning.
Teaching is organized through a variety of learning activities, including classroom teaching, guest lectures, company visits, group project work, and individual assignments — often involving interdisciplinary challenges and always with an application-oriented perspective. In addition to the academic content, these different learning methods help develop the students’ ability to work both independently and collaboratively.
Common to all these activities is that EK consistently aims to establish clear objectives for the learning activities. - Exam
The learning outcomes of the exam are identical with the learning outcomes of the subject(s)/modul(es)
Prerequisites for access to the examinationIt is a prerequisite for being admitted to the exam that the student submits 2–4 written assignments, which must be approved before the student takes the exam for the first time.
The assignments will be described during the semester.
Failure to fulfill this prerequisite means that the student will have used one exam attempt.Exam in one or more subjectsSubject/module is tested standaloneType of examOral examination30 minutes, including deliberation.
The student starts with a 10 minutes presentation.Individual exam or group examIndividualExam languagesEnglishDuration30 minutes, including deliberation.
The student starts with a 10 minutes presentation.Type of evaluation7-point grading scaleExaminersInternal censure
In the subject Digital Forensics you will receive 53 hours of instruction, which corresponds to 70 lessons (1 lesson = 45 min.) and 19% of your total workload for the subject.
The teaching primarily consists of the following activities: classroom teaching, group work, exercises.
The preparation primarily consists of the following activities: group work, exercises.
Read about KEAs Study Activity Model
*KEA can deviate from the number of hours if this is justified by special circumstances