The use of simulation in digital forensics teaching

Simulation at different levels of fidelity has been used in education and training for many years. This paper will look at the use of simulation in this area of Computer Science education, and reports on a number of different simulation tools in use in the University of Portsmouth. Central to digital forensics education is a life cycle that involves forensically safe seizure of digital evidence, imaging of digital devices, their investigation, report writing, and acting as an expert witness in court. Several of these activities are suitable for simulation based education. In teaching of digital forensics at the University of Portsmouth simulation of forensically safe seizure has used simulation. This usually involves constructing a scenario where a running computer is seized and imaged, which involves using an office like room, and providing a computer that has been suitably prepared. Many universities now have 'forensic houses' which are simulated crime scenes, that are used to support a variety of forensic disciplines, and these can provide a suitable context for seizure simulations. The University of Portsmouth has operated a forensic house for about five years. Another area of simulation is in court room work. Many digital forensic specialists will be required to give evidence in court at some stage of their career. Again, a number of universities have set up simulated court rooms, and the University of Portsmouth opened its crown court room simulation in February 2010. The simulated court room is a room laid out as a crown court, with video recording facilities, and external features such as jury rooms, interview rooms and facilities to support the giving of video evidence. This year the digital forensic students were required to give evidence in this court as part of their assessment. Although the court was not fully simulated (only roles of defence and prosecution council, judge, usher, and accused were represented) the experience was reported by students as being quite intense. The benefits brought to the unit by simulation were mainly in terms of increasing enjoyment and motivation among the students. All the staff involved in the teaching were surprised by the almost ecstatic reaction of many students on the unit to the simulation experience. The main disadvantages were the costs involved in setting up simulations, which are quite high, especially for the seizure simulation. Also for individual simulation the time involved was high. For example the court simulation required each student to give evidence independently, and be cross examined, even with a small MSc class this took nearly three hours. Seizure simulation involved team work, with only one student actually directly performing the seizure (under direction from her peers). In 2009-2010 we have investigated the use of virtual world simulations for digital seizure, constructing a number of test examples (with the help of students studying an interaction design unit). These potentially allow a low cost replaying of seizure scenarios, allowing individual students to experience different scenarios on demand. A similar opportunity exists for familiarisation with court room procedure. We will evaluate these low fidelity simulations with students in 2010-2011.