Host-Based Forensics provides a systematic introduction to the field of digital forensics. The course aims to familiarize students with the forensic process and to apply forensic principles with many tools of the trade. Upon completion of this course, a student should feel confident in participating in a digital forensic investigation. This course focuses on the forensic process (planning, acquisition, analysis, reporting) as it relates to host system forensics. This course will also concentrate on providing introduction to cyber crime and on the collection and analysis of evidence left on the cyber world. A student will feel comfortable with the full scope of a cyber forensic investigation. Class periods will consist of lecture and exercise. Students will learn about the data types that may have forensic value; and will be introduced to several techniques for capturing data off the network and how each option impacts the data that is available. Students will be further presented with several incident response challenges on live networks and be tasked with determining and proving what happened. They will have to collect various logs, network traffic, create timelines, and draw conclusions