188.922 Digital Forensics
This course is in all assigned curricula part of the STEOP.
This course is in at least 1 assigned curriculum part of the STEOP.

2021W, VU, 2.0h, 3.0EC
Lecture TubeTUWEL


  • Semester hours: 2.0
  • Credits: 3.0
  • Type: VU Lecture and Exercise
  • LectureTube course
  • Format: Distance Learning

Learning outcomes

After successful completion of the course, students are able to conduct digital forensic investigations and the necessary analysis steps, in particular with the special requirements regarding reproducibility. The data will not be modified during that analysis at all costs. This is true for both smartphones as well as file systems, computer systems, servers and network data. Students are empowered to prove that data has not been modified in any way during their analysis.

During the practical assigments participants will conduct anaylsis of artefacts in an autonomous and provable way, including documentation. Findings can be reproduced by external analysts, and are free of speculations and arguments which are not independently observable. The artefacts created like reports and analysis steps are theoretically usable in a court.

Subject of course

Forensics methods for: File systems, networks, operation systems, application software

Time line anylsises, standards and norms (RFC, NIST, ISO, legal basics, definitions).


Teaching methods

The foundations are taught in blocked lectures. These foundations are discussed in the light of real-world examples during the lectures. We additionally foster discussion by using TUWEL as an online learning platform for our course. Theoretical foundations are finally applied to practical assignments (challenges).

Mode of examination


Additional information

ECTS Breakdown (3 ECTS = 75 hours):

  • Lectures (18h)
  • Self-studies & Learning for Exams (20h)
  • up to 4 Assignments (36h)
  • Exam (1h)



Course dates

Tue10:00 - 11:0005.10.2021 https://tuwien.zoom.us/j/96778878067?pwd=QkE1cUZxM1ZqTGtmNXhvOXJWSXNOZz09 (LIVE) (LIVE)Presentation of all security lectures
Wed16:00 - 18:0006.10.2021 - 24.11.2021 https://tuwien.zoom.us/j/99411337157?pwd=aFhqVHRUZ0NTZjkxc1o2OWo4K3ZBdz09 (LIVE) (LIVE)Lecture
Fri16:30 - 17:3005.11.2021 https://tuwien.zoom.us/j/96878468881?pwd=b0hKTERhTk53a1pBalh1STdYd2J6Zz09 (LIVE)Q&A Assignment 2
Mon16:00 - 18:0010.01.2022 Online (LIVE)Exam Q&A
Wed16:00 - 18:0012.01.2022 Online (LIVE)Exam
Digital Forensics - Single appointments
Tue05.10.202110:00 - 11:00 https://tuwien.zoom.us/j/96778878067?pwd=QkE1cUZxM1ZqTGtmNXhvOXJWSXNOZz09 (LIVE)Presentation of all security lectures
Wed06.10.202116:00 - 18:00 https://tuwien.zoom.us/j/99411337157?pwd=aFhqVHRUZ0NTZjkxc1o2OWo4K3ZBdz09 (LIVE)Lecture
Wed13.10.202116:00 - 18:00 https://tuwien.zoom.us/j/99411337157?pwd=aFhqVHRUZ0NTZjkxc1o2OWo4K3ZBdz09 (LIVE)Lecture
Wed20.10.202116:00 - 18:00 https://tuwien.zoom.us/j/99411337157?pwd=aFhqVHRUZ0NTZjkxc1o2OWo4K3ZBdz09 (LIVE)Lecture
Wed27.10.202116:00 - 18:00 https://tuwien.zoom.us/j/99411337157?pwd=aFhqVHRUZ0NTZjkxc1o2OWo4K3ZBdz09 (LIVE)Lecture
Wed03.11.202116:00 - 18:00 https://tuwien.zoom.us/j/99411337157?pwd=aFhqVHRUZ0NTZjkxc1o2OWo4K3ZBdz09 (LIVE)Lecture
Fri05.11.202116:30 - 17:30 https://tuwien.zoom.us/j/96878468881?pwd=b0hKTERhTk53a1pBalh1STdYd2J6Zz09Q&A Assignment 2
Wed10.11.202116:00 - 18:00 https://tuwien.zoom.us/j/99411337157?pwd=aFhqVHRUZ0NTZjkxc1o2OWo4K3ZBdz09 (LIVE)Lecture
Wed17.11.202116:00 - 18:00 https://tuwien.zoom.us/j/99411337157?pwd=aFhqVHRUZ0NTZjkxc1o2OWo4K3ZBdz09 (LIVE)Lecture
Wed24.11.202116:00 - 18:00 https://tuwien.zoom.us/j/99411337157?pwd=aFhqVHRUZ0NTZjkxc1o2OWo4K3ZBdz09 (LIVE)Lecture
Mon10.01.202216:00 - 18:00 OnlineExam Q&A
Wed12.01.202216:00 - 18:00 OnlineExam

Examination modalities

Practical assignments and a written exams at the end.


DayTimeDateRoomMode of examinationApplication timeApplication modeExam
Mon - 20.06.2022oral01.02.2022 00:00 - 20.06.2022 00:00TISSRetake Exam

Course registration

Begin End Deregistration end
02.09.2021 00:00 15.10.2021 23:00 19.10.2021 23:59



No lecture notes are available.

Previous knowledge

Equivalent knowledge to the class "Introduction to Security" is mandatory. The class "Internet Security" is recommended.