Course Overview
This course introduces students to the scientific principles of digital forensics and provides a good forensic evidence acquisition experience with the most common digital devices found today. Students will learn the fundamental components of a forensic investigation, including proper evidence collection, the chain of custody, and forensic standards for legal evidence. Students will understand how to forensically acquire laptop/desktop computers, mobile phones, Raid arrays and USB drives, as each device type often requires a unique combination of skills, techniques and forensic tools to capture a forensic image that can be used for evidentiary purposes. The course offers a brief introduction to data recovery methods and techniques, which would assist the future investigator in extracting data from non-functioning digital devices.
Prerequisite(s)
- Admission to a Forensic credential program or permission of the Program Coordinator.
Credits
3.0
Registration requirements
Departmental approval is required to register for this course. You must have approval from the department to register. Students accepted into a program can register directly.
Domestic fees
$904.80
International fees are typically 3.4 times the domestic tuition. Exact cost will be calculated upon completion of registration.
Learning Outcomes
Upon successful completion of the course, the student will be able to:
- Describe the structure and components of digital devices related to digital forensics.
- Explain the overall flow and structure of a digital forensic investigation.
- Explain how information is stored and extracted from different types of data storage devices.
- Identify Windows/Mac computer-based artifacts.
- Perform Initial data recovery procedures.
- Select the best method of forensic evidence collection to be implemented for a given device.
- Execute the acquisition of a complete forensic image using different forensic tools on a variety of devices (tablets, mobile phones, Desktop/laptop computers, RAID arrays, Flash-based devices).
- Conduct RAM acquisition.
- Prepare and present detailed, court-acceptable notes outlining every step in the acquisition process.
Effective as of Winter 2024
Related Programs
Introduction to Digital Forensics and Evidence Imaging (FSCT 7509) is offered as a part of the following programs:
- Indicates programs accepting international students.
- Indicates programs eligible for students to apply for Post-graduation Work Permit (PGWP).
School of Computing and Academic Studies
- Forensic Investigation (Digital Forensics and Cybersecurity Option)
Advanced Certificate Part-time
- Forensic Investigation (Digital Forensics and Cybersecurity Option)
Bachelor of Technology Full-time/Part-time
Course Offerings
Fall 2026
Below is one offering of FSCT 7509 for the Fall 2026 term.
CRN 45033
Dates
Sep 14 - Dec 14 Loading
- CRN 45033
- $904.80 Domestic fees
Class meeting times
| Dates | Days | Times | Locations |
|---|---|---|---|
| Sep 14 - Sep 21 | Mon | 18:00 - 21:30 | Burnaby SE12 Rm. 318 |
| Sep 28 - Oct 05 | Mon | 18:00 - 21:30 | Online |
| Oct 19 | Mon | 18:00 - 21:30 | Online |
| Oct 26 - Nov 09 | Mon | 18:00 - 21:30 | Burnaby SE12 Rm. 318 |
| Nov 16 | Mon | 18:00 - 21:30 | Online |
| Nov 23 | Mon | 18:00 - 21:30 | Burnaby SE12 Rm. 318 |
| Nov 30 | Mon | 18:00 - 21:30 | Online |
| Dec 07 - Dec 14 | Mon | 18:00 - 21:30 | Burnaby SE12 Rm. 318 |
Duration
13 weeks
Instructor
Ilia Lvovski
Course outline
Course outline TBD — see Learning Outcomes in the interim.
Important information
- Important course information will be sent to you prior to your course start date. Check your myBCIT email account to access this information.
- This is a hybrid synchronized offering (online and F2F) on Mondays for 13 weeks. There is no class Oct 12th for Thanksgiving. In person (F2F) classes are: Sept 14, 21, Oct 26, Nov 2, 9, 23, Dec 7 and 14th. Online: Sep 28, Oct 5, 19, Nov 16, and 30th. Students who have been accepted into a Forensics program where this course is a part of the matrix may register without any further approvals. Students who are not currently accepted in a Forensics program or, if this course is NOT part of your program matrix, please contact the Program Assistants for departmental approval at BCIT_Forensics@bcit.ca.
Confirmation
Required
To proceed with registration and add this course to the cart, please confirm:
No approval yet? Request approval You must have approval from the department to register. Students accepted into a program can register directly.
Status
If you have any questions about this course, please contact us.
Programs and courses are subject to change without notice. Find out more about BCIT course cancellations.