ENPM687

Prerequisite: Experience with both Windows and Unix-based operating systems, including using the command line. Credit only granted for: ENPM808P or ENPM687. Formerly: ENPM808P. Students will implement a robust incident response methodology, including proper forensic handling of evidence, and cover legal aspects of national and international law regarding forensics. The bulk of the course covers evidence acquisition, preservation, analysis and reporting on multiple platforms.