Developing a New Digital Forensics Curriculum

Similar documents
Categories of Digital Investigation Analysis Techniques Based On The Computer History Model

Extracting Hidden Messages in Steganographic Images

System for the Proactive, Continuous, and Efficient Collection of Digital Forensic Evidence

Unification of Digital Evidence from Disparate Sources

Monitoring Access to Shared Memory-Mapped Files

A Correlation Method for Establishing Provenance of Timestamps in Digital Evidence

Rapid Forensic Imaging of Large Disks with Sifting Collectors

An Evaluation Platform for Forensic Memory Acquisition Software

File Classification Using Sub-Sequence Kernels

CAT Detect: A Tool for Detecting Inconsistency in Computer Activity Timelines

Honeynets and Digital Forensics

A Functional Reference Model of Passive Network Origin Identification

The Normalized Compression Distance as a File Fragment Classifier

Fast Indexing Strategies for Robust Image Hashes

File Fragment Encoding Classification: An Empirical Approach

Hash Based Disk Imaging Using AFF4

Design Tradeoffs for Developing Fragmented Video Carving Tools

On Criteria for Evaluating Similarity Digest Schemes

Multidimensional Investigation of Source Port 0 Probing

A Novel Approach of Mining Write-Prints for Authorship Attribution in Forensics

Privacy-Preserving Forensics

Designing Robustness and Resilience in Digital Investigation Laboratories

Ranking Algorithms For Digital Forensic String Search Hits

Android Forensics: Automated Data Collection And Reporting From A Mobile Device

Archival Science, Digital Forensics and New Media Art

A Strategy for Testing Hardware Write Block Devices

Can Digital Evidence Endure the Test of Time?

A Study of User Data Integrity During Acquisition of Android Devices

Automated Identification of Installed Malicious Android Applications

Breaking the Performance Wall: The Case for Distributed Digital Forensics

BinComp: A Stratified Approach to Compiler Provenance Attribution

A Framework for Attack Patterns Discovery in Honeynet Data

Leveraging CybOX to Standardize Representation and Exchange of Digital Forensic Information

Imani Palmer ipalmer2.web.engr.illinois.edu

Information Assurance In A Distributed Forensic Cluster

Why Should I become a Member?

New and Exciting Partner Opportunities September June 2019

Viewing Class Reserve Summary

Surveying The User Space Through User Allocations

Short courses presented by the NWU Programme in Forensic Accountancy

UCD Centre for Cybersecurity & Cybercrime Investigation

Lessons Learned from the Construction of a Korean Software Reference Data Set for Digital Forensics

Way to new challenges

The CISM Education Plan (updated August 2006)

Teleporter: An Analytically and Forensically Sound Duplicate Transfer System

2014 HONEYNET PROJECT WORKSHOP SPONSORSHIP OPPORTUNITIES

Network Forensics Analysis with Evidence Graphs

Reach your potential. Activate your membership

Our Vision Professional Community

How to Register for Classes

Cybercrime Capacity Building a cooperative process

Security Program Design:

2013 HONEYNET PROJECT WORKSHOP SPONSORSHIP OPPORTUNITIES

Syllabus. Course Title: Cyber Forensics Course Number: CIT 435. Course Description: Prerequisite Courses: Course Overview

Security and Privacy Mechanisms: An Analysis of Cloud Service Providers for the US Government

A Comparative Study of Teaching Forensics at a University Degree Level

Bachelor of Arts in Media Studies and Production: Media Production Track

Accounting Program Review Conducted

Business Process Document Student Records: Processing Block Enrollments

Can Digital Evidence Endure the Test of Time?

IEEE Standards and Smart Grid

How to Combine Sections

The National Organization of Black Law Enforcement Executives (NOBLE) A NOBLE Focus on Collaboration and Unity. & Tomorrow

TRB Annual Meeting Event Planner (Volunteer) User Guide

Workshops. 1. SIGMM Workshop on Social Media. 2. ACM Workshop on Multimedia and Security

Science No equivalent course YES. Human Anatomy and Physiology YES

Print an MS Review or a Class Enrollment Report

Manatee County Government Administrative Center Commission Chambers, First Floor 9:00 a.m. - August 24, 2017

Computer Networking Program Review Conducted

Workforce Education: Composite Materials Technology

Better skilled workforce

22nd TF-CSIRT Meeting, Porto

CR 6D Specialisation in Forensic Accounting

SANS Vendor Events. SANS offers a variety of events which bring you in touch with the highly qualified SANS community.

This tutorial explains the process for entering effort in the new FACET module.

PARENT CONNECTION COMMON ISSUES

TRB Annual Meeting Event Planner (Volunteer) User Guide

APNIC support for Internet development

University Core Curriculum Requirements

HUB: Printing the Schedule of Classes

The IFPUG Software Measurement Certification. Betsy Clark Presentation to the PSM Technical Working Group February 24, 2004

CoSci 487 SYLLABUS Introduction to Networks

NetApp Certified Storage Associate Hybrid Cloud

Working with investment professionals

Certified Fraud Examiner Study Guide 2017

The National Organization of Black Law Enforcement Executives (NOBLE) & Tomorrow

Comprehensive Program Review Report

SANS Vendor Offerings Detail

Digital Forensics as a Big Data Challenge

Availability of Datasets for Digital Forensics & what is missing

SEPTEMBER 24-25, 2017 Lucknow, India SPONSORSHIP KIT SPONSORSHIP KIT.

CAR Management Briefing Seminar

HOW TO ENROLL IN EARLY START CLASSES AT CAL POLY POMONA

Security Program Design:

Strengthening Capacity in Cyber Talent sans.org/cybertalent

BENEFITS of MEMBERSHIP FOR YOUR INSTITUTION

Business. Business Education Department Philosophy

Summary of ANU China Studies External Panel Recommendations

Introduction. January 1, 2015

PROFITING FROM APACHE BRANDS WITHOUT LOSING YOUR SOUL. Shane Curcuru Vice President, Brand Management The Apache Software Foundation

Transcription:

DIGITAL FORENSIC RESEARCH CONFERENCE Developing a New Digital Forensics Curriculum By Anthony Lang, Masooda Bashir, Roy Campbell and Lizanne Destefano Presented At The Digital Forensic Research Conference DFRWS 2014 USA Denver, CO (Aug 3 rd - 6 th ) DFRWS is dedicated to the sharing of knowledge and ideas about digital forensics research. Ever since it organized the first open workshop devoted to digital forensics in 2001, DFRWS continues to bring academics and practitioners together in an informal environment. As a non-profit, volunteer organization, DFRWS sponsors technical working groups, annual conferences and challenges to help drive the direction of research and development. http:/dfrws.org

1" Anthony"Lang,"Masooda&Bashir," Roy"Campbell,"Lizanne"DeStefano" University"of"Illinois"at"Urbana"Champaign" DFRWS"2014"

Undergraduate"cerFficate"program" SelfHcontained"curriculum"package" Three"courses:"one"basic,"one"advanced," "one"special"topics" HandsHon"lab"exercises" Designed"with"express"intent"to"distribute" Covers"all"fundamental"disciplines" Computer"science,"law,"social"science,"psychology,"and" accounfng" Currently"revising"for"insFtuFonal"distribuFon" hop://publish.illinois.edu/digitalhforensics/" " 2"

Increased"use"of"digital"devices" necessitates"development"of"a" standardized"curriculum" Field"plays"a"major"part"of" many"invesfgafons" SFll"a"new/rapidlyHdeveloping" area"of"study" Presents"a"challenging"posiFon" for"the"educafon"community" 3"

Establishment"important"for"several"reasons:" Provides"means"for"validaFng"qualificaFons" More"efficient"screening"for"expert"witnesses" Simplifies"evaluaFon"of"degree"opFons" Increases"employability"for"such"degrees" Spring"2013"workshop:"" Findings"indicate"that"adopFon"" of"curriculum"hindered"by"pracfcality" 4"

5" These"observaFons"are"by"no"means"novel,"and"there"have"been" concerted"efforts"from"the"digital"forensics"educafon"community"to" establish"standardized"curriculum."" The"American"Academy"of"Forensic"Sciences"(AAFS)" Forensic"Science"EducaFon"Programs"AccreditaFon"Commission" (FEPAC),"published"and"offers"accreditaFon"based"on,"a"standard"that" includes"digital"forensics" Forensic"Science"EducaFon"Programs"AccreditaFon"Commission"(FEPAC" " 2012)" Forensic"Science"EducaFon"Programs"AccreditaFon"Commission"(FEPAC" " 2014)"! However,""only"a"few"universiFes"has"adopted"this"standard"and" received"their"accreditafon"for"digital"forensics"

Balancing"training"and"educaFon" Textbook"selecFon" Finding"qualified"faculty" Lab"setup" SelecFng"appropriate"prerequisites" Lack"of"curriculum"standards" 6"

SelfHcontained"curriculum"package" Instructor"course"content"handbook"" Lab"exercises"handbook" PresentaFon"lecture"slides" Remedial"reading"sources" Homework/exam"quesFon"sets" Topics"organized"by"modules" Combined"to"form"a"coherent"narraFve" 7"

Lower"entry"barrier"for"insFtuFons" Work"toward"curriculum"standardizaFon" Provide"educaFonal"introducFon"to"the"field" Reflect"all"fundamental"disciplines"of"the"field" Make"curriculum"accessible"and"useful" 8"

Curriculum"objecFves:" Focus"on"computer"forensics,"network"forensics,"and" mobile"device"forensics"" Provide"relevant"interdisciplinary"perspecFves" Necessity"of"relying"on"upHtoHdate"material" Requiring"knowledge"prerequisites"rather"than" course"prerequisites" 9"

16Hweek"course"consisFng"of:" Two"75Hmin"lecture"sessions"per"week" One"60Hmin"lab"session"per"week" Course"topics"organized"in"modules:" Psychology,"computer"forensics,"U.S."legal"system," network"forensics,"law,"fraud"examinafon,"and"mobile" device"forensics"and"malware" 10"

Pilot Class Topics, by Module Define&digital&forensics&and&its&subfields& Evidence"handling/ScienFfic"Method" & Psychology& Psychology"of"cyber"crime" Criminal"profiling" & & Computer&forensics& IntroducFon"to"file"systems" NTFS"analysis" Deleted"file"recovery"and"file"carving" Windows"Registry,"log"files,"link"files,"Recycle"Bin" Web"browser"forensics,"email"forensics,"EXIF" 11"

12" U.S.&legal&system& Disputes,"courtroom"workgroup,"aOorneys" Judges,"juries,"legal"process" Network&forensics& Networking"fundamentals"review" Network"evidence"acquisiFon" Protocol"analysis,"packet"analysis,"flow"analysis" ApplicaFon"protocols,"staFsFcal"flow"analysis" Network"intrusion"detecFon"and"analysis" Law& Fourth"Amendment:"reasonable"expectaFon"of"privacy" Warrant"vs."subpoena,"Federal"Rules"of"Evidence" Privacy"laws,"computer"crime"laws"

13" Fraud&examinaDon& IntroducFon"to"fraud"examinaFon" CharacterisFcs"and"skills"of"a"forensic"accountant" The"nature"and"extent"of"fraud,"Benford's"Law" Mobile&device&forensics&and&malware& Mobile"device"technology"fundamentals" Mobile"device"evidence"extracFon"and"analysis" Mobile"network"evidence" Legal"and"ethical"consideraFons"of"intercepFon" Malware"taxonomy,"detecFon,"and"circumvenFon"

14" 1. CoordinaFon"between"instructors/modules"proved" challenging" 2. Differing"understandings"of"the"knowledge" prerequisites"among"the"professors/students" Wide"range"in"levels"of"computer"literacy" Some"students"struggled"during"lab"exercises"

3. Enrollment"consisted"mainly"of"Computer""""" """"""Science"and"Law"students" Law"students"had"difficulty"with"technical"aspect" compared"to"computer"science"students" Decision"to"shii"focus"to"invesFgaFve"and"evidenFary" complexifes" Lab"modules"revised"to"include"more"teamwork"between" Law"and"Computer"Science"students" 15"

Illinois"Science,"Technology,"Engineering,"and" MathemaFcs"EducaFon"IniFaFve"(IHSTEM)" EvaluaFon"intended"to"provide"feedback"on" implementafon"and"efficacy"of"curriculum" Evaluators"collected"data"using"the"following:" " 1. Three"student"surveys:"pre,"mid,"and"endHcourse" 2. Course"and"lab"secFon"observaFons" 3. Mid"and"end"focus"groups"with"students" 16"

17"

18"

19"

20"

Students"felt"there"was"a"lack"of"communicaFon" among"the"instructors" Topics"felt"out"of"place"and"did"not"fit"together" Suggested"using"a"single,"longHterm"case"study" PotenFal"benefit"of"glossary"of"technical"terms" 21"

IncorporaFng"a"ficFFous"case"study"that"advances"as" the"course"progresses" Changing"order"of"modules" NonHtechnical"material"before"technical"material" Highlight"wider"social"impact"of"the"field" Other"modules"will"be"ordered"to"best"fit" 22"

23" Four"changes"to"address"computer"literacy" 1. Extend"focus"on"invesFgaFons,"evidence"analysis,"and" group"acfvifes"to"earlier"parts"of"course" 2. Offer"students"a"primer"on"technical"fundamentals" 3. QuickHreference"glossary"of"terminology" 4. Prerequisite"quiz"for"compleFon"before"course" enrollment""

Alpha"version"of"curriculum"package"available"in" Summer"2014" Welcome"any"feedback"from"educaFon,"research," and"professional"communifes" Dedicated"Workshop"Aug"7,"2014"H"DFRWS" Developing"curriculum"for"advanced"course"to"be" piloted"at"uiuc"in"spring"2015" " hop://publish.illinois.edu/digitalhforensics/" 24"

We"would"like"to"acknowledge"the"aOendees"of"the"2013"Digital" Forensics"Curriculum"Standards"(DFCS)"workshop"for"their" engaging"discussions"and"invaluable"feedback."" " This"work"was"supported"by"the"NaFonal"Science"FoundaFon" under"grant"no."dueh1241773."" " QuesDons?& mnb@illinois.edu& 25"

2024 © technodocbox.com Privacy Policy | Terms of Service | Feedback