ISA 785: Research in Digital Forensics - Fall 2011

[Class Schedule] [Available Projects]

Instructor: Angelos Stavrou
Lecture: Wednesday 7:20pm - 10:00pm
Nguyen Engineering Building 5358 [Campus Map]
Office Hours: Wednesday 4:30pm - 6:30pm and by appointment
Office: Research I, Rm 437
Email: astavrou()

Teaching Assistant: Chen Liang
Research I, Rm 438
Office Hours: Monday 4:00pm - 6:00pm
Email: cliang1()

Course Description:

This class will be focused on current research and challenges in Digital Forensics including:

Class Objectives

This course offers an in depth introduction to the principles, techniques, tools and current practices used in digital forensics including latest research advances. By the end of the course, students will gain experience in:


CS 571 (Operating Systems), CS 555 (Computer Networks), and ISA 562 (Information Security Theory & Practice); or permission of instructor. The coursework will include substantial programming projects; in order to be able to complete the projects, the students must be comfortable with Java or another programming language.


Required: [TextBook available online for GMU students]
File System Forensic Analysis by Brian Carrier.
Addison-Wesley Professional, (March 27, 2005) ISBN-13: 9780321268174
[Online for GMU] [Pearson] [Amazon]

On this web page you will also find assigned reading from on-line articles, law opinions, and research publications. I will also have supplementary materials on reserve or handed out during class. Although we will not read the entire Carrier book, and we will use it for only a portion of the class, it cannot be replaced with other materials.

Recommended: [TextBook available online for GMU students]
System Forensics, Investigation, and Response, John R. Vacca; K. Rudolph.
Jones & Bartlett Learning, (September 24, 2010) ISBN-13: 9780763791346
[Online for GMU] [Jones & Bartlett Learning] [Amazon]


The students must achieve a total score of at least 90 (out of 100) to be considered for an A. This class is an advanced graduate-level class and is geared towards understanding the fundamental concepts behind Digital Forensics. The students will be expected to participate in large projects under the guidance of the instructor.

Computer Accounts:

All students should have accounts on the central Mason Unix system (also known as
and on IT&E Unix cluster (Instructions and related links are here). Please read the FAQ if you have any questions. Students can work in IT&E computer labs for programming projects during the specified hours.

Please read the University's Academic Honesty Page and GMU Honor Code.

Disability Statement
If you have a documented learning disability or other condition that may affect academic performance you should:
1) Make sure this documentation is on file with the Office of Disability Services.
All academic accommodations must be arranged through the ODS.
2) Talk with me to discuss your accommodation needs.

Other Usefull Resources
Writing Center: A114 Robinson Hall; (703) 993-1200;
University Libraries: “Ask a Librarian”
Counseling and Phychological Services (CAPS): (703) 993-2380;
University Policies: The University Catalog,, is the central resource
for university policies affecting student, faculty, and staff conduct in university affairs.

Class Schedule