ARKV3100 Document forensics Course description

The course combines theory, methods, and practical work in document forensics, situated at the intersection of technical rigor, legal frameworks, and analytical investigation. Its primary goal is to determine the authenticity and integrity of documents.

Language of instruction is English. If no English-speaking students are enrolled in the course, the course can be conducted in Norwegian.

The recommended prerequisite knowledge for the course is a basic technical proficiency with computers. Students should be able to navigate a file explorer, locate files, and understand fundamental file attributes such as location, size, and ownership.

None

After completing the course, the student should have the following overall learning outcomes defined in terms of knowledge, skills and general competence:

Knowledge

• a solid understanding of how digital evidence is identified, collected, preserved, and documented without compromising its integrity.
• comprehensive familiarity with relevant laws and standards, evidentiary requirements in a court of law, and how the police and other law-enforcement agencies handle digital documents.
• insight into the most commonly used digital formats as well as other pertinent metadata standards that can reveal provenance, modifications, and timelines.
• ability to assess how emerging technologies affect the methods and challenges of document forensics.

Skills

• can undertake the collection and preservation of digital evidence within a forensic life‑cycle.
• can apply relevant standards and operate within the framework of applicable legislation.
• can analyse and interpret metadata belonging to various document formats and evaluate the authenticity and integrity of documents.
• can identify and evaluate new and emerging technologies within the field of document forensics.

General competence

• possesses a an understanding of the forensic life cycle and the preservation of digital evidence.
• has insight and familiarity with the legal and standards‑based framework for evidentiary handling.
• can conduct technical analyses of documents and assess the impact of emerging technologies.

Learning approaches and work alternate between lectures, data labs, discussions, self‑study, and group work. The teaching takes place with in-person attendance on campus.

To be eligible to sit for the exam, the student must submit three written assignments.The purpose of these assignments is to help the student structure their learning throughout the semester. The assignments may be completed individually or in groups (maximum 4 students per group). Each assignment should be roughly 2-3 pages in length (4,600 - 6,900 characters, including spaces).

All assignments must be completed and approved by the prescribed deadline for the student to be allowed to sit for the exam. If one or more assignments are not approved, the student may submit an improved version once before the specified deadline.

The exam for the subject is a written individual semester assignment on a given topic with a length of 23,000 characters, including spaces. The cover page, table of contents, bibliography, and any appendices are additional. The exam can be submitted in Norwegian.

A student who receive a fail grade are given one opportunity to submit an improved version of the semester assignment for assessment.

All aids are permitted, as long as the student follows the rules for examinations, source use and referencing, and OsloMet's guidelines for using artificial intelligence (AI) in student assignments.

Grade scale A-F

The exam papers are assessed by one internal and one external examiner. At least 10% of the exam papers, or at least 10 exam papers, will be assessed by two examiners. The grades awarded for the papers assessed by two examiners form the basis for determining the level for all the exam papers.

Thomas Sødring