practical issues in teaching computer forensics dr. iain sutherland information security research...

Practical Issues in Teaching Computer

Forensics Dr. Iain Sutherland

Information Security Research Group, School of

Computing.

Northumbria University 18-11-05 2

The demand for coursesThere appears to be growth in the number of courses:

• Attention in the media• Undergraduate

– A number of new courses

• Postgraduate forensics and related courses– Glamorgan– Cranfield – Westminster– Royal Holloway – Bradford– University of East London+ others...

Northumbria University 18-11-05 3

The Practical IssuesThe teaching of computer forensics can present a number of practical problems relating to:

• Students • Material• Resources• Staff

The following slides are based on the experience of teaching computer forensics to undergraduate and postgraduate students for a number of years.

Northumbria University 18-11-05 4

Do the students know we exist?• A couple of searches on www.ucas.com 26/10/05

A search for “computer forensics”A search for “computer French”

They did have an advert for Northumbria University on the courses index page...

Northumbria University 18-11-05 5

Students• The usual issues

– Mixed backgrounds / skills – Mixed ability– Mixed cultures

• Specific problems – What are they expecting, CSI? (without

the gooey stuff) or Silent Witness? – Can they cope with the nature of the

material?Both Technical and content?

Northumbria University 18-11-05 6

Material • The subject area is huge

– Computing, forensics and psychology (and others)

– The subject area is still fairly ‘young’

• Potential problems of ethics– The material covered as part of the

course– Case studies – certain sensitivities– Should we be teaching the students

some of these skills?

Northumbria University 18-11-05 7

Resources

• To do properly – expensive!• Resources both for teaching

and student projects – Hardware, including network

infrastructure– Software such as AccessData

or Encase etc • Developing ‘case material’

Northumbria University 18-11-05 8

Staff

• Staff issues include– Time to stay ‘current’ in the

field!– Research activity / consultancy

• The subject area is specialised, although ISRG staff came from a variety of fields.

Northumbria University 18-11-05 9

Our Solutions...

Things we have found that work so far include:

1. Develop relationships with a variety of people and organisations • Gain experience• Advice on course content /

structure • Guest speakers...

Northumbria University 18-11-05 10

Our Solutions2. Initially kit out a teaching lab with free

/cheap tools

HOWEVER

Better to do it properly – buy the real thing!

Ideally a closed network with access to tools / test systems / Images

Northumbria University 18-11-05 11

Our Solutions...3. Underpin the teaching with

research and/or consultancy to provide: • Case studies• Technical background • Anecdotal information

Northumbria University 18-11-05 12

Glamorgan Computer Forensics Lab

To date, average laboratory running / refurbishing costs about £20K per year

Set up as a research / consultancy lab and focuses on recovering data from HDD expanded to handle PDA’s and Cellular phones!

Northumbria University 18-11-05 13

Practical Issues - Summary • Develop relationships with Law

Enforcement Agencies / business world

• Computer Forensics be expensive to teach in terms of time and resources so build up the kit slowly.

• Consider teaching material carefully for ethical issues

• Teaching benefits from being underpinned by consultancy / research work

Northumbria University 18-11-05 14

Any Questions?