Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 1 of 23 ITC597 - Digital Forensics Session 1 2016 Faculty of Business School of Computing and Mathematics Internal Mode Subject Overview This subject provides an in-depth study of the rapidly changing and fascinating field of computer forensics. It combines both the technical expertise and the knowledge required to investigate, detect and prevent digital crimes. The subject covers the knowledge on digital forensics legislations, digital crime, forensics processes and procedures, data acquisition and validation, e-discovery tools, e-evidence collection and preservation, investigating operating systems and file systems, network forensics, art of steganography and mobile device forensics, email and web forensics, presenting reports and testimony as an expert witness. Learning outcomes On successful completion of this subject, you should be able to determine and explain the legal and ethical considerations for investigating and prosecuting digital crimes; be able to formulate a digital forensics process; be able to evaluate the technology in digital forensics to detect, prevent and recover from digital crimes; be able to analyse data on storage media and various file systems; be able to collect electronic evidence without compromising the original data; be able to evaluate the functions and features of digital forensics equipment, the environment and the tools for a digital forensics lab; be able to critique and compose technical tactics in digital crimes and assess the steps involved in a digital forensics investigation; be able to prepare and defend reports on the results of an investigation. Lecturer Details Subject Coordinator Rajasekaran Lakshmiganthan Email [email protected] Phone To be advised. Contact phone number 0399357944 Campus To be advised. Building/Room number To be advised. About your lecturer Mr Chetanpal Singh M ERP & IT, MSc, BE, SAP Consultant I have earned my Masters in ERP from Monash University, Masters in IT from Victoria University and Bachelor Degree in Engineering. I also hold certifications from SAP in FI/CO, ABAP, HR, Implementation and Business Intelligence. My current research and studies are based on collaborating the database from our big companies and to present an easy approach to extract reports in dashboards . I have been awarded by Research Technical Support Australia for my further studies in my field. I will be working with IBM and ORACLE to collaborate the data for Australia. Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 2 of 23 I have worked with companies such as Wilson, Telstra, KPMG and Deloitte. So, I have a vast experience of 12 years with MNC's but also wide knowledge of studies. Learning, Teaching and Support Strategies Class times and location Lecture: Fridays 1.00pm-4.00pm, Room 4.11 (Lab) General Timetable will be available at the following website before the start of 201630 semester, which can be accessed on any Mobile Phone or IPAD https://csutimetable.au.studygroup.com/Melbourne How to contact your lecturer Any questions concerning the teaching of this subject can be made by contacting your Subject Lecturer. Lecturer Name : Chetanpal Singh Lecturer Email : [email protected] Email is the best option. Please send a brief message regarding the issue and include the subject name and code in your email ?it really helps to know which class you belong to, before I respond to your query. If you prefer to phone me that is fine, but please leave a message if I am not there at the time ? I will give you a call back as soon as I can. How you are expected to engage with the subject All of your subject materials are available on the Interact2 website under the Topics link in the left hand menu. I suggest that for each topic you read the learning objectives carefully and attempt the weekly activities. The topics are available online only, you can download and print topics as you like. In this subject there are also lots of opportunities for you to engage with Lecturer, with your peers and with the subject. All classes will be conducted face to face where we can discuss subject content and assessment items. The details of times and dates are mentioned in the subject outline and will also be available on the timetable website. Interaction with your fellow students and the Subject Coordinator is very important to enhance your learning in this subject. You should check the Interact2 site at least weekly for postings, announcements, and other resources that will assist your studies or additional information and resources vital to your success in the subject. To support your engagement with the subject following additional resouces can be available. Library Services The CSU Library website provides access to online material and print, using Primo Search to find online journal articles, eBooks, hardcopy books from CSU Library (see Library Manager for Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 3 of 23 Interlibrary Loan Requests), company & government reports, eJournals, dissertations, theses, newspapers including Business & Financial newspapers in Factiva (See Business & IT Journal Databases), and other reference resources (eg. Australian Bureau of Statistics, Australian standards, online encyclopaedias & dictionaries to be read on the computer). You will also find library guides, Subject Reserve for any readings eg. ITC100, ACC100, etc., and online assistance to help you use the Library's resources such as Ask a Librarian – Live Chat and Ask a Librarian - Web Form. In this subject there are also lots of opportunities for you to engage with me, with your peers and with the subject. I will be holding a number of online meetings throughout the session where we can discuss subject content and assessment items. The details of times and dates will be posted on the Interact site. Interaction with your fellow students and the Subject Coordinator is very important to enhance your learning in this subject. You should check the Interact site at least weekly for postings, announcements, online meeting information and other resources that will assist your studies or additional information and resources vital to your success in the subject. Library Services You can find Library Services on both the SGA library online catalogue: http://primo.unilinc.edu.au/primo_library/libweb/action/search.do?vid=SGA The SGA library online catalogue allows students to Sign In, My Account shows student's current library record including all books on loan, Renew your borrowed books online before the due date, also Search and Request all books in the SGA library, even if unavailable due to high demand from students. Students can Request books when all books are on loan to other students. When the requested book is returned to the SGA library, the student who requested the book receives an email immediately to pick up the book from the SGA library. View your library record online 24/7 at the above web link for SGA library. And also CSU Library online: http://student.csu.edu.au/library - CSU Library Services including Primo Search & Subject Reserve online with 24/7 access, online and video tutorials in research skills, finding journal articles for assignments, topic analysis, download Endnote referencing program and many other online library services to help you successfully complete your assignments for all CSU courses. http://trove.nla.gov.au/ - Powerful search engine from National Library of Australia to access many different online resources on any subject from one search. Contact Details for renewing loans, locating books and other information: SGA Melbourne Library: Marian Lees - Director, Library Services Ph: (03) 9935 7921 Email: [email protected] Library Help http://student.csu.edu.au/library/help-contacts Friendly and quick assistance is available. Ask for help finding information and navigating the library's extensive eResources. Online Tutorials http://student.csu.edu.au/library/study-research/training-tutorials-videos Learn how to: • use Primo Search to find eReserve material and journal articles • search journal databases and web resources for information for your assessments • identify appropriate sources of information and peer reviewed material, and evaluate resources. Bookmark your Subject Library Resource Guide Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 4 of 23 Subject Library Guides are a great way to get started with research. Each online guide is tailored to a specific area of study, including Accounting, Business & Information Technology outlining how to research in your area and where to look for information. http://libguides.csu.edu.au/ Academic Learning Support Assistance Visit the learning support website for advice about assignment preparation, academic reading and note-taking, referencing, and preparing for exams at: http://student.csu.edu.au/study You may also contact: Name: Monique Moloney Email: [email protected] Phone: (03) 9935 7919 For appointments, please see Reception. Queries regarding the content of this subject should be directed to your subject lecturer. Your workload in this subject Each week you should spend around 9 - 11 hours studying this subject – obviously some weeks may require more time than other depending on how you work – but the following is a guide for your information. Online meetings and supporting readings (2 hours) Weekly activities (4-5 hours) Participation in weekly online discussion (1 hour) Preparation of assessment items (2 hours) Text and Learning Materials Prescribed text(s) Check the textbook database (link below) to ensure you have the correct textbook indicated. Textbooks listed in this database have already been ordered for this session https://online.csu.edu.au/de/dewtext.sqt?run=List Students must have access to a copy of the following prescribed textbook: Nelson, B., Phillips, A., & Steuart, C. (2015). Guide to Computer Forensics and Investigations (5/e). Boston, MA. Course Technology Schedule Session Week Week Commencing Modules/Topics Readings and Activities 1 29 February 2016 Topic 1: Understanding digital forensics and investigations Read Text Chapter 1: Complete activities listed in the Topics 2 7 March 2016 Topic 2: Digital crime: civil and crime law Complete Readings 1 & 2: Complete activities listed in the Topics 3 14 March 2016 Topic 3: Forensics process, policies and procedures Read Text Chapter 2: Complete activities listed in the Topics Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 5 of 23 Session Week Week Commencing Modules/Topics Readings and Activities 4 21 March 2016 Topic 4: Data acquisition and validation Read Text Chapter 3 & 9: Complete activities listed in the Topics 5 28 March 2016 Topic 5: E-Evidence, guidelines and standards Read Text Chapter 4: Complete activities listed in the Topics Assessment item 1 due on 28 March 2016 6 4 April 2016 Topic 6: E-Discovery, tools, environments and equipment Read Text Chapter 6: Complete activities listed in the Topics 11 April 2016 Mid-session break 18 April 2016 Mid-session break 7 25 April 2016 Topic 7: Investigating operating systems and analyzing file systems Read Text Chapter 5 and 7: Complete activities listed in the Topics 8 2 May 2016 Topic 8: Virtual machines, email and network forensics Read Text Chapter 10 & 11: Complete activities listed in the Topics 9 9 May 2016 Topic 9: Steganography and mobile device forensics Read Text Chapters 8 & 12: Complete activities listed in the Topics 10 16 May 2016 Topic 10: Cloud forensics Read Text Chapter 13: Complete activities listed in the Topics Assessment item 2 due on 16 May 2016 11 23 May 2016 Topic 11: Reporting and presenting Read Text Chapter 14: Complete activities listed in the Topics 12 30 May 2016 Topic 12: Expert witness and ethics Read Text Chapter 15 & 16: Complete activities listed in the Topics Examination period (refer to the exam time table for the exam date/time for this subject) Assessment Information Introduction to assessment To protect the academic integrity of the subject, you may be asked to complete an additional test (which may be verbal) if I or another member of the teaching staff have doubts that the work that you have submitted for an assessment item is your own. This test would be held within 4 weeks of the submission of the assessment. Detailed information regarding: Sample exam (for subjects with a formal exam) Pass requirements Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 6 of 23 Grades Presentation Submissions Extensions Penalties for late submission Assignment return Resubmission Plagiarism are included in Appendix 1. Assessment Items Item number Title Type Value Due date* Return date** 1 Assignment 1 - Tasks Assignment 20% 28-Mar-2016 19-Apr-2016 2 Assignment 2 - Tasks and Forensics Report Assignment 30% 16-May-2016 07-Jun-2016 3 Final Exam Exam 50% To be Advised. - * due date is the last date for assessment items to be received at the University ** applies only to assessment items submitted by the due date Assessment item 1 Assignment 1 - Tasks Value: 20% Due date: 28-Mar-2016 Return date: 19-Apr-2016 Submission method options Alternative submission method Task Task 1: Hands-On Projects (10 Marks) Complete following Hands-On Projects from the textbook (Nelson, Phillips, & Steuart 2015): Hands-On Project 1-3 (2 marks) Hands-On Project 1-5 (2 marks) Deliverable: Insert C1Prj03 and C1Prj05 reports in your assignment document. Complete following Hands-On Projects from the textbook (Nelson, Phillips, & Steuart 2015): Hands-On Project 3-1 (2 marks) Hands-On Project 4-3 (4 marks) Deliverable: For project 3-1 provide screenshots of all steps taken to complete the project along with description of each step. For project 4-3 provide a one-page paper explaining the importance of the files you examined. How might they affect a patent case? Task 2: Case Project (5 Marks) Your supervisor has asked you to research current acquisition tools. Using your preferred Internet search engine and the vendors listed in Chapter 2 of the textbook, prepare a report containing the following information for each tool and stating which tool you would prefer to use: • Forensics vendor name Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 7 of 23 • Acquisition tool name and latest version number • Features of the Vendors' product With this data collected, prepare a spreadsheet or table listing vendors in the rows. For the columns headings, list the following features: • Raw format • Proprietary format • AFF format • Other proprietrary format the tool can read • Compression of image files • Remote network acquisition capabilities • Method used to validate (MF5, SH-1, and so on. (Nelson, Phillips, & Steuart 2015) Deliverable: Spreadsheet or table inserted in the assignment document. Task 3: Research Project (5 Marks) You have just been hired to perform digital investigations and forensics analysis for a company. You find that no policies, processes, or procedures are currently in place. Do an Internet search to find information, and then create a policy and processes document to provide the structure necessary for your lab environment. Be sure to cite your online sources. (Nelson, Phillips, & Steuart 2015) Deliverable: Policy and process no more than 500 words inserted in the assignment document. Rationale This assessment task covers digital crime, forensic process and procedures, data acquisition and validation, e-evidence, e-discovery tools and equipment. This assessment has been designed to ensure that you are engaging with the subject content on a regular basis. More specifically it seeks to assess your ability to: determine the legal and ethical considerations for investigating and prosecuting digital crimes formulate a digital forensics process evaluate the technology in digital forensics to detect, prevent and recover from digital crimes analyse data on storage media and various file systems collect electronic evidence without compromising the original data evaluate the functions and features of digital forensics equipment, the environment and the tools for a digital forensics lab Marking criteria Task 1: Hands-On Projects (10 Marks) Criteria HD 100% - 85% DI 84% - 75% CR 74% - 65% PS 64% - 50% FL 49% - 0 Hands-On Projects 1.3 and 1.5 (4 marks) Projects are completed, evidence of all steps is provided, Complete report is inserted in the assignment. Projects are completed, evidence of most steps is provided, report is inserted in the assignment. Projects are mostly completed, some minor errors in report. Projects mostly completed but with errors, some steps are missing, report is missing some details. Evidence of some steps is provided, reports are missing most details. Possible marks 4.0 – 3.4 3.3 – 3.0 2.29 – 2.6 2.5 – 2.0 1.9 – 0 Hands-On 3.1 Project 3.1 Project 3.1 Project 3.1 Project 3.1 Evidence of Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 8 of 23 Projects 3.1 and 4.3 (6 marks) completed, screenshots of all steps are provided with informative description. 4.3 One page paper explains well the importance of files and how might they affect a patent case. completed, screenshots of most steps are provides with good description. 4.3 One page paper explains the importance of files and how might they affect a patent case. mostly completed, some minor errors are apparent in the screen shots, description is reasonable. 4.3 One page paper explains the importance of files but its not clear how might they affect a patent case. completed but with errors, some screenshots are missing, description is not clear. 4.3 One page paper does not adequately explain the importance of files and how might they affect a patent case. some steps, most screenshots are missing. 4.3 Importance of files is not provided or missing most information Possible marks 6.0 – 5.1 5.0 – 4.5 4.4 – 3.9 3.8 – 3.0 2.9 – 0 Task 2: Case Project (5 Marks) Criteria HD 100% - 85% DI 84% - 75% CR 74% - 65% PS 64% - 50% FL 49% - 0 Spreadsheet or Table containing vendor name, tool and version and listing features The table contains the required information and all features are listed. The table contains the required information and most features are listed. The table contains the required information and some features are listed. The table contains some information and some features are listed. The table contains little or no required information. Possible marks 5.0 – 4.25 4.24 – 3.75 3.74 – 3.25 3.24 – 2.5 2.4 – 0 Task 3: Research Project (5 Marks) Criteria HD 100% - 85% DI 84% - 75% CR 74% - 65% PS 64% - 50% FL 49% - 0 Create a policy and processes document for a company to perform digital investigations and forensics analysis. The policy and process document is well written and provides a comprehensive structure necessary for a forensics lab environment. The policy and process document is well written and provides a good structure necessary for a forensics lab environment. The policy and process document is well written and provides mostly a good structure necessary for a forensics lab environment. The policy and process document is well written and provides mostly a good structure necessary for a forensics lab environment, but contains some minor deficiencies. The policy and process document has major issues and/or does not provide necessary structure for a forensics lab environment. Possible marks 5.0 – 4.25 4.24 – 3.75 3.74 – 3.25 3.24 – 2.5 2.4 – 0 Presentation Ensure all tasks are identified with headings. Use single reference list at the end of document. Submit the assignment in ONE word or pdf file on EASTS. Please do not submit *.zip or *.rar or multiple files Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 9 of 23 Assessment item 2 Assignment 2 - Tasks and Forensics Report Value: 30% Due date: 16-May-2016 Return date: 07-Jun-2016 Submission method options Alternative submission method Task Task 1: Recovering scrambled bits (5 Marks) For this task I will upload a text file with scrambled bits on the Interact site closer to the assignment due date. You will be required to restore the scrambled bits to their original order and copy the plain text in your assignment. Deliverable: Describe the process used in restoring the scrambled bits and insert plain text in the assignment. Task 2: Revealing hidden information from an image (5 Marks) For this task I will provide an image with hidden information in it. You will be required to reveal the hidden information. Deliverable: Describe the process used to reveal the hidden information from the image and copy the revealed information in the assignment in plain text. Task 3: Forensics Report (20 Marks) In this major task you are assumed as a Digital Forensics Examiner. Considering a real or a hypothetical case you are required to produce a formal report consisting of facts from your findings to your attorney who has retained you. You are free to choose a forensics scenario which can be examination of a storage media (HDD, USB Drive etc), email or social media forensics, mobile device forensics, cloud forensics or any other appropriate scenario you can think of. Deliverable: A forensics report of 1800-2000 words. Rationale This assessment task covers data validation, e-discovery, steganography, reporting and presenting, and has been designed to ensure that you are engaging with the subject content on a regular basis. More specifically it seeks to assess your ability to: determine the legal and ethical considerations for investigating and prosecuting digital crimes analyse data on storage media and various file systems collect electronic evidence without compromising the original data; evaluate the functions and features of digital forensics equipment, the environment and the tools for a digital forensics lab; compose technical tactics in digital crimes and assess the steps involved in a digital forensics investigation; prepare and defend reports on the results of an investigation Marking criteria Task 1: Recovering scrambled bits (5 Marks) Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 10 of 23 Criteria HD 100% - 85% DI 84% - 75% CR 74% - 65% PS 64% - 50% FL 50% - 0 Successfully recovering the scrambled bits to their original order (5 marks) Scrambled bits are restored to the original text. Tool used to decode the text is mentioned and justification to use the tool is also provided. The process to restore the scrambled bits is clearly described with screenshots inserted of all steps. Scrambled bits are restored to the original text. Tool used to decode the text is mentioned but the justification is not very clear. The process to restore the scrambled bits is described with some screenshots. Scrambled bits are restored to the original text. Tool used to decode the text is mentioned but the justification is not very clear. The process to restore the scrambled bits is described but no screenshots provided. Scrambled bits are restored to the original text. No justification of tool used is provided, process seems to be somewhat vague. Scrambled bits are restored but not matching with the original text. Tool is not mentioned and process is not described. Possible marks 5.0 – 4.25 4.24 – 3.75 3.74 – 3.25 3.24 – 2.5 2.4 – 0 Task 2: Revealing hidden information from an image (5 Marks) Criteria HD 100% - 85% DI 84% - 75% CR 74% - 65% PS 64% - 50% FL 50% - 0 Successfully revealing hidden text from an image (5 marks) Hidden text is revealed. Tool used to reveal the text is mentioned and justification to use the tool is also provided. The process to reveal the text is clearly described with screenshots inserted of all steps. Hidden text is revealed. Tool used to reveal the text is mentioned but the justification is not very clear. The process to restore the text is described with some screenshots. Hidden text is revealed. Tool used to reveal the text is mentioned but the justification is not very clear. The process to restore the text is described but no screenshots provided. Hidden text is revealed. No justification of tool used is provided, process seems to be somewhat vague. Hidden text is revealed but not matching with the original text. Tool is not mentioned and process is not described. Possible marks 5.0 – 4.25 4.24 – 3.75 3.74 – 3.25 3.24 – 2.5 2.4 – 0 Task 3: Forensics report (20 Marks) Criteria HD 100% - 85% DI 84% - 75% CR 74% - 65% PS 64% - 50% FL 50% - 0 Introduction: Background, scope of engagement, tools and findings (3 marks) All elements are present, well expressed, comprehensive and accurate. All elements are present and largely accurate and well expressed. All elements are present with few inaccuracies. Most elements are present possibly with some inaccuracies. Fails to satisfy minimum requirements of introduction. Possible 3.0 – 2.55 2.54 – 2.25 2.24 – 1.95 1.94 – 1.5 1.4 – 0 Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 11 of 23 marks Analysis: relevant programs, techniques, graphics (5 marks) Description of analysis is clear and appropriate programs and techniques are selected. Very good graphic image analysis. Description of analysis is clear and mostly appropriate programs and techniques are selected. Good graphic image analysis. Description of analysis is clear and mostly appropriate programs and techniques are selected. Reasonable graphic image analysis. Description of analysis is not completely relevant. Little or no graphics image analysis provided. Fails to satisfy minimum requirements of analysis. Possible marks 5.0 – 4.25 4.24 – 3.75 3.74 – 3.25 3.24 – 2.5 2.4 – 0 Findings: specific files/images, type of searches, type of evidence, indicators of ownership (5 marks) A greater detail of findings is provided. Keywords and string searches are listed very clearly. Evidence found is very convincing. Indication of ownership is very clear. Findings are provided, keywords and string searchers are listed. Evidence is sound. Ownership is clear. Findings are provided, some keywords are listed. Evidence is reasonable which relates to the ownership. Findings are provided but are somewhat vague. Keywords and strings are not very clear. Evidence found may be questionable. Fails to satisfy minimum requirements providing findings. Possible marks 5.0 – 4.25 4.24 – 3.75 3.74 – 3.25 3.24 – 2.5 2.4 – 0 Conclusion: Summary, Results (3 marks) High level summary of results is provided which is consistent with the report. Well summarised results and mostly consistent with the findings. Good summary of results. Able to relate the results with findings. No new material is included. Satisfies the minimum requirements. Results are not really consistent with the findings. Fails to satisfy minimum requirements of summarising the results. Possible marks 3.0 – 2.55 2.54 – 2.25 2.24 – 1.95 1.94 – 1.5 1.4 – 0 References: Must cite references to all material used as sources for the content (2 marks) APA 6th edition referencing applied to a range of relevant resources. No referencing errors. Direct quotes used sparingly. Sources all documented. APA 6th edition referencing applied to a range of relevant resources. No more than 2 referencing errors. Direct quotes used sparingly. Sources all documented. APA 6th edition referencing applied to a range of relevant resources. No more than 3 errors. Direct quotes used in-context. Sources all documented. APA 6th edition referencing applied to a range of relevant resources. No more than 4 errors. Direct quotes used in-context. Some sources documented. Referencing not done to the APA 6th edition standard. Over-use of direct quotes. Range of sources used is not appropriate and/or not documented. Possible marks 2.0 – 1.7 1.6 – 1.5 1.4 – 1.3 1.2 – 1.0 0.9 – 0 Glossary / Appendices: (2 marks) Glossary of technical terms used in the report is provided which has generally acceptable source of definition of the terms and appropriate references are included. Relevant supporting material Glossary of technical terms used in the report is provided which has mostly acceptable source of definition of the terms and appropriate references are included. Some supporting Glossary of some technical terms used in the report is provided which has mostly acceptable source of definition of the terms and appropriate references are Glossary of some technical terms used in the report is provided however terms are not generally common and some references are missing. Some supporting material is provided in appendices. Most terminologies are missing. Appendices are either not provided or are irrelevant. Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 12 of 23 is provided in appendices to demonstrate the evidence. material is provided in appendices to demonstrate the evidence. included. Some supporting material is provided in appendices to demonstrate the evidence. Possible marks 2.0 – 1.7 1.6 – 1.5 1.4 – 1.3 1.2 – 1.0 0.9 – 0 Presentation Following should be included as minimum requirements in the report structure: • Executive Summary or Abstract This section provide a brief overview of the case, your involvement as an examiner, authorisation, major findings and conclusion • Table of Content • Introduction Background, scope of engagement, forensics tools used and summary of findings • Analysis Conducted o Description of relevant programs on the examined items o Techniques used to hide or mask data, such as encryption, steganography, hidden attributes, hidden partitions etc o Graphic image analysis • Findings This section should describe in greater detail the results of the examinations and may include: o Specific files related to the request o Other files, including deleted files that support the findings o String searches, keyword searches, and text string searches o Internet-related evidence, such as Web site traffic analysis, chat logs, cache files, e-mail, and news group activity o Indicators of ownership, which could include program registration data. • Conclusion Summary of the report and results obtained • References You must cite references to all material you have used as sources for the content of your work • Glossary A glossary should assist the reader in understanding any technical terms used in the report. Use a generally accepted source for the definition of the terms and include appropriate references. • Appendices You can attach any supporting material such as printouts of particular items of evidence, digital copies of evidence, and chain of custody documentation. Follow the referencing guidelines for APA 6 as specified in Referencing Guides (http://student.csu.edu.au/study/referencing-at-csu). Submit the assignment in ONE word or pdf file on EASTS. Please do not submit *.zip or *.rar or multiple files. Assessment item 3 Final Exam Value: 50% Date: To be advised Duration: 2 Hours Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 13 of 23 Submission method options N/A - submission not required/applicable Rationale Covering all topics, this assessment task has been designed to assess your ability to: • determine the legal and ethical considerations for investigating and prosecuting digital crimes • formulate a digital forensics process • evaluate the technology in digital forensics to detect, prevent and recover from digital crimes • analyse data on storage media and various file systems • collect electronic evidence without compromising the original data; • evaluate the functions and features of digital forensics equipment, the environment and the tools for a digital forensics lab; • compose technical tactics in digital crimes and assess the steps involved in a digital forensics investigation; • prepare and defend reports on the results of an investigation Requirements Close book examination consists of: Short answer questions and case study. All questions must be answered. It is your responsibility to ensure that you are aware of the requirements for completing the exam and that you attend the exam site on the correct date and at the correct time. The School of Computing and Mathematics will not accept misreading the exam time as misadventure. Marking criteria Part A – 5 Short Answer Questions (8 marks each) Criteria HD 100% - 85% DI 84% - 75% CR 74% - 65% PS 64% - 50% FL 49% - 0 Demonstrate an ability to analyse, reason and discuss the concepts learned in the subject (This includes content from online meetings, textbook chapters, modules, readings and forum discussions) Demonstrate an ability to analyse, reason and discuss the concepts to draw justified conclusions that are logically supported by examples and best practice. Answers succinctly integrate and link information into cohesive and coherent piece of analysis and consistently use correct forensics terminologies and sophisticated language. Demonstrate an ability to analyse, reason and discuss the concepts to draw justified conclusions that are logically supported by examples and best practice. The answers are logically structured to create cohesive and coherent piece of analysis that consistently use correct forensic terminologies. Demonstrate an ability to analyse, reason and discuss the concepts to draw justified conclusions that are generally logically supported by examples and best practice. The answers are generally logically structured to create a comprehensive, mainly descriptive piece of analysis. Some use of correct forensic terminologies. Demonstrate an ability to analyse, reason and discuss most concepts to draw justified conclusions that are generally logically supported by examples and best practice. The answers are partially structured into loosely-linked rudimentary sentences to create a comprehensive, descriptive piece of analysis. Some use of correct forensic terminologies. Demonstrate an ability to analyse, reason and discuss some concepts to draw conclusions that are generally logically supported by examples. The answers are partially structured and may tend to list information. Uses frequent informal language. Possible marks 8.0 – 6.8 6.7 – 6.0 5.9 – 5.2 5.1 – 4.0 3.9 – 0 Part B – One Case Study Question (10 marks) Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 14 of 23 Criteria HD 100% - 85% DI 84% - 75% CR 74% - 65% PS 64% - 50% FL 49% - 0 Use the concepts learned in the subject to solve the case (This includes content from online meetings, textbook chapters, modules, readings and forum discussions) Use the concepts learned in the subject to solve the case which demonstrates an ability to analyse and reason the concepts to draw justified conclusions that are logically supported by examples and best practice. Answer succinctly integrates and link information into cohesive and coherent piece of analysis and consistently use correct forensics terminologies and sophisticated language. Use the concepts learned in the subject to solve the case which demonstrates an ability to analyse and reason the concepts to draw justified conclusions that are logically supported by examples and best practice. Answer is logically structured to create cohesive and coherent piece of analysis that consistently use correct forensic terminologies. Use the concepts learned in the subject to solve the case which demonstrates an ability to analyse and reason the concepts to draw justified conclusions that are generally logically supported by examples and best practice. Answer is generally logically structured to create a comprehensive, mainly descriptive piece of analysis. Some use of correct forensic terminologies. Use the concepts learned in the subject to solve the case which demonstrates an ability to analyse and reason most concepts to draw justified conclusions that are generally logically supported by examples and best practice. Answer is partially structured into loosely-linked rudimentary sentences to create a comprehensive, descriptive piece of analysis. Some use of correct forensic terminologies. Use the concepts learned in the subject to solve the case which demonstrates an ability to analyse and reason the concepts to draw conclusions that are generally logically supported by examples. Answer is partially structured and may tend to list information. Uses frequent informal language. Possible marks 10.0 – 8.5 8.4 – 7.5 7.4 – 6.5 6.4 – 5.0 4.9 – 0 Material provided by the University Answer Booklets (2 X 12 page) Material required by the student Writing implements, including a 2B pencil and an eraser. Any calculator allowed, including programmable calculators (hand held, no printer). i-pads, smart phones and other hand-held devices are not accepted as calculators. Appendix 1 Assessment Information Sample exam PART A: Short Answer Questions (40 marks) (Each question is worth 8 marks. Answer the questions in the Answer booklet provided.) 1. Why validation is considered the most critical aspect of digital forensics? What are some of the design goals of Advanced Forensics Format? List some of the considerations to take to prevent copies of the evidence from damaging and losing. [2+3+3 Marks] 2. What are the criminal rules of search and seizure? Differentiate digital forensics investigation process in the corporate environment and the criminal environment. Describe some of the actions to follow if you discover evidence of a crime during a company policy investigation. [2+2+4 Marks] 3. What is the significance of snapshots in Virtual Machine (VM) related investigations? List some of the recommended steps to take when conducting a forensics analysis of a Virtual Machine. [3+5 Marks] Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 15 of 23 4. Where is the system data stored in mobile phones and why it is there? What is the biggest challenge with mobile forensics? Describe the steps to analyse a mobile device. [2+2+4 Marks] 5. What are the forensics examiners' two roles in testifying? What is disqualification? Describe some of the factors to disqualify an expert. [2+2+4 Marks PART B: Case Study (10 marks) (Read the following case carefully and answer the question in the Answer booklet provided.) Mr. Jones at Company A claims to have received an order for $200,000 in widgets from the purchasing manager, Mr. Smith, at Company B. Company A manufactures the widgets and notifies Company B that they are ready for shipment. Mr. Smith at Company B replies that they didn't order any widgets and won't pay for them. Company A locates an e-mail requesting the widgets that appears to be from Mr. Smith and informs Company B about the e-mail. Company B tells Company A that the e-mail didn't originate from its e-mail server, and it won't pay for the widgets. Company A files a lawsuit against Company B based on the widget order in Mr. Smith's e-mail. The lawyers for Company A contact the lawyers for Company B and discuss the lawsuit. Company A's lawyers make discovery demands to conduct a computer forensics analysis on Mr. Smith's computer and hopes of finding the original message that caused the problem. At the same time, Company B's lawyers demand discovery on Mr. Jones's computer because they believe the e-mail is a fake. As a computer forensics investigator, you receive a call from your boss asking you to fulfil the discovery demands from Company B's lawyers to locate and determine whether the e-mail message on Mr. Jones's computer is real or fake. Because it's an e-mail investigation, not a major crime involving computers, you're dispatched to Company A. When you get there, you find Mr. Jones's computer powered on and running Microsoft Outlook. The discovery order authorises you to recover only Mr. Jones's Outlook e-mail folder, the .pst file. You are not authorised to do anything else. Question: What tasks would you perform in solving this case? Pass Requirements You must obtain at least 50% in both the examination and the total mark in order to pass this subject. To be eligible for the grade AA or AE you must have submitted all assessment items in the subject, including the final exam. If you choose not to complete an assessment item or do not sit the final exam then you will not be granted an AA or an AE grade. Grades Final grades for this subject are awarded by the Business Faculty Assessment Committee in accordance with the University's Assessment Regulations. (See current Academic Regulations at https://policy.csu.edu.au/view.currect.php?id-00301#s3 (https://policy.csu.edu.au/view.currect.php?id=00301#s3)). University's Assessment Policy: Coursework Subjects (https://policy.csu.edu.au/view.current.php?id=00301). Your final grade for the subject as a whole will be based on the grading scale outlined in the CSU Assessment Policy: Coursework Subjects https://policy.csu.edu.au/view.current.php?id=00301 (https:// policy.csu.edu.au/view.current.php?id=00301). HD High Distinction 85% - 100% An outstanding level of achievement in relation to the assessment process. DI Distinction 75% - 84% Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 16 of 23 1. 2. 3. A high level of achievement in relation to the assessment process. CR Credit 65% - 74% A better than satisfactory level of achievement in relation to the assessment process. PS Pass 50% - 64% A satisfactory level of achievement in relation to the assessment process. FL Fail 0 - 49% An unsatisfactory level of achievement. The percentages specified above should be viewed only as guidelines for the award of final grades. The Faculty has an obligation to ensure that grades are equitable across different cohorts of the same subject offering and will undertake appropriate moderation processes to ensure that grades are awarded consistently in accordance with the University's Moderation Policy. For further information please consult the CSU Assessment Policy: Coursework Subjects http://policy.csu.edu.au/view.current.php?id=00301 Presentation For information on the presentation of your assessment items you should refer to the marking criteria for each assessment item. The following link provides study resources, such as referencing, writing, grammar and punctuation, and study planning: http://student.csu.edu.au/study Submission Online Submission Assignments should be submitted through TurnItIn. TurnItIn password details for this subject will be given by your lecturer. TurnItIn does not accept Excel files and PDF files. Assignments must be submitted to Turnitin by midnight (AEST) of the date specified. Extensions In order to ensure that students who hand their assignments in on time are not disadvantaged, and to enable the lecturer to comply with the requirement to return assignments to the class within 21 days, the following rules about extensions will be strictly enforced: Extensions cannot be granted for online tests, as these have to be done within a specific time frame, after which the answers are released to the class automatically. Computer problems (such as the speed of your computer and the time it may take you to upload assignments onto EASTS) and normal work-related pressures and family commitments do not constitute sufficient reasons for the granting of extensions. If it becomes obvious that you are not going to be able to submit an assignment on time because of an unavoidable problem, you must submit your request for an extension to the Subject Coordinator in writing (email or post) prior to the due date. Requests for extensions will not be granted on or after the due date so you must make sure that any extension is requested prior to the day on which the assignment is due. You are expected to do all you can to meet assignment deadlines. Work and family related pressures do not normally constitute sufficient reasons for the granting of extensions or Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 17 of 23 3. 4. 5. 6. 7. 8. incomplete grades. If you apply for an extension, you may be asked to email your lecturer on what you have done so far on the assignment. You must be able to provide documentary evidence (such as a certificate from a doctor or counsellor) justifying the need for an extension as soon as practicable - but please note that if the circumstances giving rise to the request for an extension arise on a day when you cannot get documentary evidence, you must still apply for the extension before the due date and submit the documentary evidence afterwards. Given the tight deadlines involved in returning assignments to students and putting feedback on Interact, the maximum extension granted generally will be seven (7) days from the due date. Assignments received more than 10 days after the due date or extension date will not be marked unless the staff member decides otherwise. Items received late will be penalised at 10% of the mark available for the assessment item per day it is late (see below Penalties for Late Submission). Note that for purposes of measuring lateness, the 'day' begins just after 00.00 hrs AEST - so an assignment received after midnight of the due date will be penalised 10% for lateness. This rule will be applied to all students uniformly. Penalties for Late Submission The Faculty of Business has determined that the penalty for the late submission of an assessment task (without obtaining the Subject Coordinator's approval for an extension) will be: 10% deduction per day, including weekends, of the maximum marks allocated for the assessment task, i.e. 1 day late 10% deduction, or 2 days late 20% deduction. An example of the calculation would be: Maximum marks allocated = 20 Penalty for one day late = 2 marks (so, a score of 18/20 becomes 16/20 and a score of 12/20 becomes 10/20). If an assignment is due on a Friday but is not submitted until the following Tuesday, then the penalty will be four days (40% deduction or 8 marks in the example above). Submissions more than 10 days late will be acknowledged as received but will not be marked. Assignment Return You should normally expect your marked assignment to be despatched/returned to you within three weeks of the due date, if your assignment was submitted on time. If an assignment is submitted on time but not returned by the return date, you should make enquiries in the first instance to the subject coordinator. Resubmission Under normal circumstances resubmission of assessment items will not be accepted for any of the assessments required in this subject. Assessment Requirements Assessment at CSU is criterion-referenced and standards-based where students' work is assessed against stated criteria that reflect the expected learning outcomes of the course and subject. Subjects that use a satisfactory/unsatisfactory grading scale will have this clearly identified within the Subject Outline. Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 18 of 23 For further information please consult the University's Assessment Policy: Coursework Subjects (https://policy.csu.edu.au/view.current.php?id=00301). Referencing Referencing is an important component of academic writing. All CSU assessment tasks should be appropriately referenced. The specific details of the referencing requirements are included in each assessment task description. For further information and assistance with referencing refer to http://student.csu.edu.au/library/integrity/referencing-at-csu Plagiarism Charles Sturt University expects that the work of its students and staff will uphold the values of academic honesty and integrity. The Guide to Avoiding Plagiarism is located at: http://student.csu.edu.au/study/plagiarism. This is an important resource that will help you understand these values and apply them in practice. You should familiarise yourself with these requirements and ensure that all assessments submitted by you are your own work, have not been submitted elsewhere and comply with the University's requirements for academic integrity. The University has purchased Turnitin software. This software has two functions, a pre-emptive education function which students may use to check their own work prior to submission, and a plagiarism detection function which academics may use to check the student's work for improper citation or potential plagiarism. Use by students is optional and is not a prerequisite for submission. You are encouraged to check your work for originality prior to submission. You can register with Turnitin to create a Student Account under the CSU Turnitin Licence at http://www.turnitin.com/login_page.asp. Further information on how to use Turnitin is provided within the Guide to Avoiding Plagiarism: http://student.csu.edu.au/study/plagiarism/checking. Appendix 2 CSU Learning and Teaching Policies Minimum standards of consultation According to the Academic Communication with Students Policy (https://policy.csu.edu.au/view.current.php?id=00139#s3) (clause 8 in section 3), when a student directly contacts a teaching staff member for information, advice and/or support (except in online teaching spaces) the teaching staff member will respond to the request within 3 working days. Clauses 19-21: Use of Online Discussion and Communication Technologies states that for each subject, the Subject Coordinator will be expected to set up and/or activate an appropriate asynchronous communication technology and respond at least once a week to student messages that request information and advice. The Higher Degree by Research Candidates Policy - Academic Communication (https://policy.csu.edu.au/view.current.php?id=00283) states that a Communication Plan, a documented agreement between a HDR candidate and his/her supervisory team that establishes common understandings and expectations of how and when communication will occur during the candidature will be developed. The Plan should then be reviewed regularly throughout candidature. University Policies and Regulations Academic matters are defined by, and are subject to, Charles Sturt University policies and regulations. Your Subject Outline should be read in conjunction with all such academic regulations and policies, as some of these may affect the outcome of your studies. Academic Progress Regulations The University requires each student to progress through his or her course at a rate that will enable him or her to complete the course in a specified maximum time. This maximum time is intended to ensure the currency of the knowledge within the course and therefore professional suitability of Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 19 of 23 graduates. Failure to complete within the specified maximum time shall lead to the expiry of a student?s enrolment in the course. The University believes that all students have a right to know in advance of study in their course exactly what constitutes satisfactory progress in that course. To this end the University will specify a maximum completion time for each course, and will also provide support to students identified as being at risk of exclusion. The Academic Progress Policy (https://policy.csu.edu.au/view.current.php?id=00250) sets out the requirements and procedures for satisfactory academic progress, for the exclusion of students who fail to progress satisfactorily and for the termination of enrolment for students who fail to complete in the maximum allowed time. Variations to Subject Outlines Should it be necessary to change the content of the Subject Outline during a teaching session, it will be done in consultation with the Head of School and other support services of the University. You then will be notified of the changes in writing by the subject coordinator. Variations to Assessment Should it be necessary to vary the assessment in this subject, you will be notified in writing by the Subject Coordinator, or Subject Convenor where one is appointed. The variations to assessment include variations to the assessment tasks and/or assessment procedures for assignments, examinations and any other assessment task published in the Subject Outline. The variations will be communicated only after the Subject Coordinator or Subject Convenor has obtained approval from their Head of School. The overriding principle is that such changes will not disadvantage students and is made in accordance with the Subject Outlines Policy (https://policy.csu.edu.au/view.current.php?id=00267). Evaluation of Subjects It is University policy that all subjects are evaluated every time that they are offered. The University's Division of Student Learning administers the Subject Experience Survey through CSU's online evaluation system. Staff in the faculties and schools value your feedback very highly and take account of your comments when reviewing learning and teaching in each subject. If you are interested in the details of any enhancements to this subject as a result of the latest survey, please contact the subject coordinator. Students can also view overall results for subjects via the Student Subject Experience Survey Results Portal: https://student.csu.edu.au/home/subject-experience-survey-results Surveys for each of the subjects you are enrolled in for this session will be available for you to complete for a period of 4 weeks from the last week of the teaching session. An email message will alert you to the availability of the surveys online. Please complete the subject evaluation by following the link: https://P8.courseval.net/etw/ets/et.asp?nxappid=CS2&nxmid=start (http:// https://P8.courseval.net/etw/ets/et.asp?nxappid=CS2&nxmid=start) Individual subject results are only reported to the Subject Coordinator and Heads of Schools after grades have been submitted for each teaching session (except where subjects have one student the results are not reported to staff). Special Consideration Academic regulations provide for special consideration to be given if you suffer misadventure or extenuating circumstances during the session (including the examination period) which prevents you from meeting acceptable standards or deadlines. Applications for special consideration must be submitted in writing and include supporting documentary evidence. Such applications should be sent to the Student Administration Office. For further information about applying for special consideration please refer to Special Consideration Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 20 of 23 Policy (https://policy.csu.edu.au/view.current.php?id=00298). Assessment Regulations The assessment practices of all University subjects are conducted in accordance with the University?s Assessment Policy: Coursework Subjects (https://policy.csu.edu.au/view.current.php?id=00301). Academic Conduct The University expects that you, as a student, will be honest in your studies and research and that you will not do anything that will interfere with or frustrate the studies and research of other students. In particular, you are expected to: acknowledge the work of others in your assignments and other assessable work; not knowingly allow others to use your work without acknowledgment; report honestly the findings of your study and research; and use only permitted materials in examinations. Details of expected academic conduct are provided in: the Student Academic Misconduct Policy (https://policy.csu.edu.au/view.current.php?id=00279); the Academic Progress Policy (https://policy.csu.edu.au/view.current.php?id=00250); Students are also expected to be responsible in the use of University facilities and resources and to abide by University rules concerning the Library and electronic resources. the Library Rule (https://policy.csu.edu.au/view.current.php?id=00280); and the Computing and Communications Facilities Use Policy (https://policy.csu.edu.au/view.current.php?id=00145). Copies of the Rule of the Library and Code of Conduct for Users of Electronic Facilities can also be obtained from the Library or the Division of Information Technology (DIT) Service Desk. Penalties for breaching the above Rule and Policies include suspension or exclusion from the University. Students also have expectations of the University and of other students in the cooperative endeavour of studying. Details of these expectations are provided in the Student Charter (https://policy.csu.edu.au/view.current.php?id=00268). Residential school There is no residential school for this subject. Subject Outline as a Reference Document This Subject Outline is an accurate and historical record of the curriculum and scope of your subject. The Subject Outline Policy (https://policy.csu.edu.au/view.current.php?id=00267) (at clause 16(f)) requires that you retain a copy of the Subject Outline for future use such as for accreditation purposes. Appendix 3 Support Services Student Central Student Central is the first point of contact for currently enrolled students to access all non-teaching services. Student Central liaises closely with Divisions and Schools to ensure the timely and accurate resolution of student enquiries. Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 21 of 23 You may direct your enquires in person to Student Central staff situated within the Learning Commons found on campus at Albury-Wodonga, Bathurst, Dubbo, Orange, and Wagga Wagga. You may also contact Student Central through: [email protected] (mailto:[email protected]) 1800 ASK CSU (1800 275 278) Phone from outside Australia: + 61 2 6933 7507 Information on Your Library Services Finding Information CSU Library provides you with free access to over 600,000 books and 50,000 journals, and much more. Get an introduction to your library with the Library Orientation Toolbox (http://www.csu.edu.au/division/library/find-info/toolbox). Primo Search Finding the resources you need is easy with Primo Search (http://primo.unilinc.edu.au/primo_library/libweb/action/search.do?dscnt=1&dstmp=1328694476534&vid=CSU&fromLogin=true). Search most of the Library's collections, including online resources, print publications and CSU research. Plus, you can easily place loan requests, view your current loans, and renew items online. Online Resources You'll find journal databases, eBook collections, and other useful online information sources listed under Key Resources (http://student.csu.edu.au/library/find-information). eReserve Some subject readings may be held in eReserve (http://student.csu.edu.au/library/find-info/search-reserve). Online access is encouraged to help reduce CSU's carbon footprint, however a printed copy of eReserve subject readings can be purchased through CSU Print (http://www.csu.edu.au/division/student-learning/technologies-for-learning-and-teaching/csu-print). Borrowing Your borrowing privileges depend on your enrolment. Visit Information for Students (http://student.csu.edu.au/library/help/information-for-students) to find out what you are eligible for. The Library FAQs (http://www.csu.edu.au/division/library/how-to/faq) have more information on borrowing and access to resources. Need help? CSU Library staff are available to answer your questions by phone, Live Chat, email, forum, or in person. See Ask a Librarian (http://student.csu.edu.au/library/contacts/ask-a-librarian) for more information. Keep up to date with what is happening in your Library through Facebook, Twitter and our blog. CSU Library Facebook (http://www.facebook.com/CSULibrary) CSU Library Twitter (http://twitter.com/CSU_Library) CSU Library Blogs (http://student.csu.edu.au/library/about-your-library/library-blog) Academic Learning Assistance CSU's Learning Skills Advisers can help you develop the skills you need to succeed in your studies. Learning Skills advisers can help you with: Understanding and preparing assignments Study skills Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 22 of 23 Exam preparation Time management Notetaking and Referencing and avoiding plagiarism Learning Skills also have specialists in English Language, online learning and maths and statistics who can support your development in these areas. Students can take advantage of online resources and workshops, forums and individual appointments either in person, or online. More information is available at student.csu.edu.au/study (http://student.csu.edu.au/study). STUDYLINK provides access to a variety of short, non-award subjects in preparation for university study. Subjects are available throughout the year through flexible, online delivery, and each is designed to help you gain confidence, skills and knowledge for your university studies ( http://www.csu.edu.au/student/studylink/). Student Support - http://student.csu.edu.au/support A wide range of services are provided to support your student academic experience. Services are available on campus with relevant services also available via telephone and online. Services provided include: Orientation Student mentoring Scholarship and financial assistance Counseling support and referral Academic appeals and legal advice referral Disability, welfare and equity support and referral Health and wellbeing Social and recreational activities Graduation Indigenous student support International student support Residential Student Support - http://student.csu.edu.au/campus/residences/residential-advisors The Residential Support Scheme operates across all campuses to provide for the pastoral care and welfare of residents and actively encourages student participation and involvement in all aspects of residential life. The residential community is supported and structured to provide an environment to support student academic achievement. For assistance and initial contact go to Student Central Email: [email protected] (mailto:[email protected]) (mailto:[email protected]) Phone: 1800 ASK CSU (1800 275 278) Phone from outside Australia: + 61 2 6933 7507 Career Development Career Development (http://student.csu.edu.au/study/careers) includes a range of services, from first through to the final year of study, which support students' self-assessment, awareness of opportunities, improvements to decision making, and gaining the necessary skills for making successful transitions post-study. This support is available face to face, via telephone and online. Distance Education Outreach Team Charles Sturt University Subject Outline ITC597 201630 SM I-9 February 2016-Version 1 Page 23 of 23 Assistance for students studying by distance education with Charles Sturt University. The DE Outreach Team is available to all CSU students studying by Distance Education. We can assist you with: Your orientation to CSU and DE study; Study skills; Preparing assignments; Time management; Online learning, and Any other questions you may have about studying by DE at CSU. We provide these services in a number of different ways including: Outreach sessions to locations around Australia including group and individual sessions; Advice and support via phone, email, and Skype; Preparing assignments; Online workshops; Regional Study Centres, and Online resources and social media. Find us at: http://student.csu.edu.au/study/de-outreach https://www.facebook.com/DistanceEDatCSU