Practical Issues in Teaching Computer
Forensics Dr. Iain Sutherland
Information Security Research Group, School of
Computing.
Northumbria University 18-11-05 2
The demand for coursesThere appears to be growth in the number of courses:
• Attention in the media• Undergraduate
– A number of new courses
• Postgraduate forensics and related courses– Glamorgan– Cranfield – Westminster– Royal Holloway – Bradford– University of East London+ others...
Northumbria University 18-11-05 3
The Practical IssuesThe teaching of computer forensics can present a number of practical problems relating to:
• Students • Material• Resources• Staff
The following slides are based on the experience of teaching computer forensics to undergraduate and postgraduate students for a number of years.
Northumbria University 18-11-05 4
Do the students know we exist?• A couple of searches on www.ucas.com 26/10/05
A search for “computer forensics”A search for “computer French”
They did have an advert for Northumbria University on the courses index page...
Northumbria University 18-11-05 5
Students• The usual issues
– Mixed backgrounds / skills – Mixed ability– Mixed cultures
• Specific problems – What are they expecting, CSI? (without
the gooey stuff) or Silent Witness? – Can they cope with the nature of the
material?Both Technical and content?
Northumbria University 18-11-05 6
Material • The subject area is huge
– Computing, forensics and psychology (and others)
– The subject area is still fairly ‘young’
• Potential problems of ethics– The material covered as part of the
course– Case studies – certain sensitivities– Should we be teaching the students
some of these skills?
Northumbria University 18-11-05 7
Resources
• To do properly – expensive!• Resources both for teaching
and student projects – Hardware, including network
infrastructure– Software such as AccessData
or Encase etc • Developing ‘case material’
Northumbria University 18-11-05 8
Staff
• Staff issues include– Time to stay ‘current’ in the
field!– Research activity / consultancy
• The subject area is specialised, although ISRG staff came from a variety of fields.
Northumbria University 18-11-05 9
Our Solutions...
Things we have found that work so far include:
1. Develop relationships with a variety of people and organisations • Gain experience• Advice on course content /
structure • Guest speakers...
Northumbria University 18-11-05 10
Our Solutions2. Initially kit out a teaching lab with free
/cheap tools
HOWEVER
Better to do it properly – buy the real thing!
Ideally a closed network with access to tools / test systems / Images
Northumbria University 18-11-05 11
Our Solutions...3. Underpin the teaching with
research and/or consultancy to provide: • Case studies• Technical background • Anecdotal information
Northumbria University 18-11-05 12
Glamorgan Computer Forensics Lab
To date, average laboratory running / refurbishing costs about £20K per year
Set up as a research / consultancy lab and focuses on recovering data from HDD expanded to handle PDA’s and Cellular phones!
Northumbria University 18-11-05 13
Practical Issues - Summary • Develop relationships with Law
Enforcement Agencies / business world
• Computer Forensics be expensive to teach in terms of time and resources so build up the kit slowly.
• Consider teaching material carefully for ethical issues
• Teaching benefits from being underpinned by consultancy / research work
Northumbria University 18-11-05 14
Any Questions?