Practical Issues in Teaching Computer

Forensics Dr. Iain Sutherland

Information Security Research Group, School of

Computing.

Northumbria University 18-11-05 2

The demand for coursesThere appears to be growth in the number of courses:

• Attention in the media• Undergraduate

– A number of new courses

• Postgraduate forensics and related courses– Glamorgan– Cranfield – Westminster– Royal Holloway – Bradford– University of East London+ others...

Northumbria University 18-11-05 3

The Practical IssuesThe teaching of computer forensics can present a number of practical problems relating to:

• Students • Material• Resources• Staff

The following slides are based on the experience of teaching computer forensics to undergraduate and postgraduate students for a number of years.

Northumbria University 18-11-05 4

Do the students know we exist?• A couple of searches on www.ucas.com 26/10/05

A search for “computer forensics”A search for “computer French”

They did have an advert for Northumbria University on the courses index page...

Northumbria University 18-11-05 5

Students• The usual issues

– Mixed backgrounds / skills – Mixed ability– Mixed cultures

• Specific problems – What are they expecting, CSI? (without

the gooey stuff) or Silent Witness? – Can they cope with the nature of the

material?Both Technical and content?

Northumbria University 18-11-05 6

Material • The subject area is huge

– Computing, forensics and psychology (and others)

– The subject area is still fairly ‘young’

• Potential problems of ethics– The material covered as part of the

course– Case studies – certain sensitivities– Should we be teaching the students

some of these skills?

Northumbria University 18-11-05 7

Resources

• To do properly – expensive!• Resources both for teaching

and student projects – Hardware, including network

infrastructure– Software such as AccessData

or Encase etc • Developing ‘case material’

Northumbria University 18-11-05 8

Staff

• Staff issues include– Time to stay ‘current’ in the

field!– Research activity / consultancy

• The subject area is specialised, although ISRG staff came from a variety of fields.

Northumbria University 18-11-05 9

Our Solutions...

Things we have found that work so far include:

1. Develop relationships with a variety of people and organisations • Gain experience• Advice on course content /

structure • Guest speakers...

Northumbria University 18-11-05 10

Our Solutions2. Initially kit out a teaching lab with free

/cheap tools

HOWEVER

Better to do it properly – buy the real thing!

Ideally a closed network with access to tools / test systems / Images

Northumbria University 18-11-05 11

Our Solutions...3. Underpin the teaching with

research and/or consultancy to provide: • Case studies• Technical background • Anecdotal information

Northumbria University 18-11-05 12

Glamorgan Computer Forensics Lab

To date, average laboratory running / refurbishing costs about £20K per year

Set up as a research / consultancy lab and focuses on recovering data from HDD expanded to handle PDA’s and Cellular phones!

Northumbria University 18-11-05 13

Practical Issues - Summary • Develop relationships with Law

Enforcement Agencies / business world

• Computer Forensics be expensive to teach in terms of time and resources so build up the kit slowly.

• Consider teaching material carefully for ethical issues

• Teaching benefits from being underpinned by consultancy / research work

Northumbria University 18-11-05 14

Any Questions?