The development of challenging assessments for computer forensics students

Teaching Computer Forensics to postgraduate students is a challenging topic. Creating an assignment that is both realistic and also helpful to students when pursuing careers in this competitive area is also a demanding task for the lecturer. In our course, the final challenge for the students is to undertake a graded task, based around a case study, analyse evidence that is key to an investigation, write a report and then present their findings in a role play scenario. The evidence that has been created is a bit-wise copy of a “suspect’s” USB stick. A number of different techniques have been used to create these evidence files. Some evidence was made relatively easy to find, while others were much more challenging. To add an extra dimension to the assessment we involved final year Law students from the School of Humanities, Law Department, to act as jury members and also to help to cross-examine the students while they presented their findings in the role of an Expert Witness. This emphasised the additional skill requirements of being able to present forensic evidence under cross-examination in a court environment, as well as giving practical focus to the way in which the evidence was gathered. It created at the same time a valuable exercise for the legal students in the context that evidence presented in courts is increasingly computer-based evidence. This paper discusses the preparation of the evidence files, the process of evaluating the results of the students work and concludes with an overview of the student experience