Réseaux et sécurité informatique

Digital Forensics is a core module within the Master's program in Computer Networks and Security. It introduces students to the theoretical foundations, methodological principles, technical procedures, and legal considerations involved in the investigation of cybercrime and digital security incidents.

The module focuses on the systematic identification, collection, preservation, examination, analysis, interpretation, and presentation of digital evidence. It enables students to understand how computer systems, networks, operating systems, storage devices, applications, and digital services can generate traces that may be used to reconstruct the circumstances of an incident or support a judicial investigation.

The course begins with an introduction to cybercrime, including unauthorized access, data alteration and destruction, digital fraud, misuse of hacking tools, and other forms of unlawful activity involving information and communication technologies. It then examines the legal and procedural framework governing digital investigations, with particular emphasis on electronic evidence, integrity, authenticity, chain of custody, privacy, data preservation, and the responsibilities of investigators.

The module subsequently presents the digital forensic investigation process, covering preparation and planning, definition of the investigation scope, identification of potential evidence sources, acquisition and preservation of digital evidence, hashing and integrity verification, artifact analysis, temporal analysis, log analysis, correlation of evidence, and timeline reconstruction. Particular attention is given to the forensic analysis of Microsoft Windows and Linux systems.

Finally, students apply the concepts and techniques acquired throughout the course to in-depth case studies involving compromised workstations, suspicious server activity, account compromise, network incidents, suspected data exfiltration, web server investigations, and hybrid computing environments.

The module adopts a methodological, technical, and evidence-oriented approach. Its objective is not to train students to conduct unauthorized intrusions, but to develop their ability to investigate and analyze digital incidents within an authorized, ethical, professional, and legally compliant framework.