Investigation of digital devices that contain evidence, including mobile and handheld devices. Topics include the analysis of memory dumps, event logs, and application caches using existing digital forensic tools as well as the development of new tools to uncover evidence and to work around the use of anti-forensics. Tools and investigations must be clearly documented, so this course contains a significant writing component.