Teaching Digital Forensics During A Pandemic: Present And Future Strategies

Online learning is nothing new to the digital forensics world. Vendors such as AccessData and Cellebrite have offered it for years, and distance learning programs at institutions like University College Dublin and DeSales University have long made it possible to earn Master’s degrees in digital forensics without ever stepping foot in a classroom.

Online learning reached new heights, however, as a result of the 2020 COVID-19 pandemic. With forensic laboratories and classrooms closed, employees and students in lockdown sought ways to continue their professional development and education — even as some found themselves helping to care for sick family members, working to keep themselves and families financially afloat, or even battling COVID-19 themselves.

Institutions and vendors both stepped up, shifting to webinars, Capture the Flag (CTF) events, and other online learning modalities supported by video chat, teleconferencing, instant messaging, and so forth.

Although hands-on research and experience became challenging, many trainers and educators saw an opportunity to learn more about their audiences and experiment with new formats. What have they found?

Filling an ongoing, immediate need

In digital forensics, training and education aren’t just good to have — they’re necessary for quality forensic examinations. That’s partly why the demand for training during lockdown accelerated. Technology — and the criminal use thereof — continues to advance, and necessarily, forensic skills alongside them.


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.


Take, for instance, the use of drones to smuggle contraband or engage in nonconsensual surveillance. Even as “pandemic drones” were used to monitor social distancing and enforce lockdowns, drug traffickers and other organized crime groups accelerated their use of drones.

Training forensic examiners to acquire and analyze evidence of this kind of activity, though, isn’t as simple as enabling a software license to use with a set of test data. Quality digital forensic training has always included a hands-on component, and drone forensics is no different.

“How do you teach a process of doing analysis of a UAV when [your students have] never physically had to pull the data from one?” asked Rob Attoe, founder and CEO of training firm Spyder Forensics. “We never thought a year ago that we would be hosting live, remote UAV classes.”

Adapting to the new reality, he said, required another approach: shipping drone kits to students. “One module is flying the aircraft, and so we’ll describe flying the aircraft,” said Attoe, adding that an operator video is available for students who want to pilot the aircraft and populate its data that way. The kits include not just the UAV, but also a write blocker and mobile device. “There’s a lot of equipment that goes with it,” Attoe said.

Shifting from the classroom to the online environment

Distance learning has been nothing new, either for trainees or students. Pre-pandemic, working students’ needs had been designed into DeSales University’s Master’s of Criminal Justice online degree program. Speaking in a Forensic Focus podcast episode recorded in November 2019, MCJ program director Joseph Walsh said, “[I]t provides the opportunity for students who are in other places to be able to get that degree that maybe they don’t have at a school near them.”

That was true for digital forensics trainees, too. Some regions of the world may rely on only one or two examiners, said Attoe, who can neither afford to travel to training, nor make it cost-effective for vendor training to come to them. “If you can host a live remote class in their time zone, then it builds a much larger audience [of those] that have the same desire to put away bad people,” he said.

As the pandemic progressed, not just training organizations like Spyder Forensics, but also institutions of higher education, experimented with online video conferencing platforms to deliver content via a combination of live and asynchronous pre-recorded sessions.

Asynchronous sessions had their own up-front costs, but offered needed flexibility for students in “essential worker” and volunteer positions, as well as international students who had returned home. That was a conclusion of “Forensic undergraduate education during and after the COVID-19 imposed lockdown: Strategies and reflections from India and the UK,” an editorial published as part of a Forensic Science International special COVID-19 and Forensic Science edition. It compared approaches between the two countries in three respects: traditional lectures, seminars, and practical sessions.

The authors of that paper saw mostly benefits in an asynchronous approach:

  • An online assignment could focus more, not less, on learning objectives.
  • Online learning could allow for more personalized instruction.
  • By offering flexibility, online learning could be more inclusive of more voices.
  • Students of forensic science could “develop some key sci-comm skills which has been recognized as being a weakness of many modern forensic science curricula.”

On the other hand, they wrote, students learning virtually for the first time could feel as if they were missing out on interactions when they were live. College students hadn’t paid or registered for distance learning, and many instructors hadn’t received training specific to these formats. That made equivalency difficult to evaluate or manage. 

Still, shorter live sessions enabled students and professors to ask and answer questions about the classes — and to check in on students’ well-being. Some examples of this delivery included:

  • Students watched a forensic technique demonstrated via video posted on the virtual learning platform, or read a document such as a court statement, ahead of a live seminar.
  • Students worked independently on an assignment between a virtual seminar presentation and a live, facilitated online class discussion about the work. “This broke up the time spent in the online session, encouraged engagement with the learning, and enabled fruitful group discussion,” the authors noted.

Authors even managed to adapt a mock trial to a virtual simulated courtroom exercise. “This gave the students the opportunity to interact in real time with the cross examination process, identify good practice and areas for improvement (which had been written into the script),” the authors wrote. The “trial” also allowed students to consider how they could have responded to questions asked during cross-examination.

The virtual environment could also spur more self-directed learning. “Furthermore,” the authors wrote, “the lack of immediate response could encourage an exercise of research skills fostering a more independent approach. On the other hand, what is lacking is the connection and to some extent the opportunity for organic discussions around the questions.”

Those challenges can be present in live online training, too, said Attoe — even for trainers who, like Attoe’s team, had years of experience with it. “A lot of the challenges that we’ve seen for any vendor is the choice of platform,” he said, “in other words, how we get the messaging over to the students in a way that makes it intuitive and interactive, and at the same time, allows them to be interactive with the classroom machines.”

That comes from mimicking a live classroom to the extent possible, with webcams, virtual and physical whiteboards, polls, and other features. For the drone class, for instance, a webcam helps instructors to walk the students through connecting the devices and if necessary, coaching them on any issues.

One crucial aspect of the live online platform is the instructor’s ability to track what students are doing — or not doing. “A good instructor will walk around and offer assistance and monitor and support,” said Attoe, “so how do you offer that in a live remote setting?”

Spyder Forensics’ answer: assign each student a lab laptop to remotely connect to. That way, the instructor has access to a rack holding 10-18 machines and can see each student’s work on each screen.

It’s the reverse of virtualizing the learning environment, which Attoe said challenges instructors. “[If one or more students have a problem] in a virtual environment, the instructor has to bring up the screen in a virtual machine. It’s difficult for the instructor in that environment to gauge where everybody is,” he explained.

Conversely, in a literal “classroom” of remote trainees, instructors can be more engaged during practical lab work. “In a live environment, where I’m looking out at ten, twenty students and everyone appears to be moving their mouse and keyboard, I can’t physically look at each one of them at any one time and know what their status is,” said Attoe. “Whereas, our training, we can see all of the machines in front of us, and we can see somebody falling behind, or [if] there are any challenges with the machine or internet that we can address separately. The instructor can go to the machine and take control of the keyboard and mouse and say, ‘Watch what I’m doing.’ So it is the closest thing to physically being there without actually being with them.”

Lockdown challenges for hands-on learning

Many of the challenges that active digital forensics labs faced during the lockdown were true for university-based labs, as well. “During the lockdown period, students were deprived of key professional activities as well competency based forensic education,” the FSI editorial observed.

Acknowledging that a return to face-to-face lab instruction would be risky — ideal only with small, appropriately distanced groups — they thought the virtual environment wouldn’t be mutually exclusive to practical learning, though they acknowledged risks in that regard, too:

“The type of student here is important, those that favor independent research will likely thrive, while those that benefit from interaction and talking things through to process ideas and knowledge may find themselves out of their comfort zone or, worse, left behind,” they wrote. 

Additionally, they recognized a socially distanced lab would conflict with the common practices of sharing space and equipment, not to mention collaboration. Josh Brunty, associate professor at Marshall University in West Virginia (US), agreed. “There’s too many factors in bringing a particular student in and exposing them to what we’re already putting our analysts through,” he said during his Forensic Focus podcast.

Internships, of course, are critical to giving students hands-on practical experience and preparing them for jobs. So Brunty worked on ways to offer either remote internships, or allow students to continue their work in the university lab.

“[I]t’s not as beneficial as sending the student on site and letting them see how the working laboratory is,” said Brunty. “But I think in the overall career arc, I think they’re going to have enough knowledge under their belt.”

That, he said, was a matter of the relationships he and others had already established, centering on the problems partner agencies have that students could solve — even remotely. “[W]hether it be encrypted apps or working with IoT devices, smart watches, or dark web research, all of those things are able to be adapted to a remote internship,” Brunty said.

Of course, learning how to follow lab safety rules is a practical matter, too, just as valuable to students as other forms of hands-on learning. Additionally, students need to be able to communicate results to examiners, and get examiner feedback on their efforts. “It’s a lot more back and forth interaction,” said Brunty, “through text messages and Skype and Zoom and [Microsoft] Teams.”

Social challenges for remote learning

Part of virtual interactivity is making students comfortable. That could be as simple as giving them the option whether to turn on their webcam, said Attoe, or trying to engage students on a more social level.

Even so, he added, in-person training allows forensic practitioners to meet their peers. That’s interaction they’re cut off from in a virtual environment. Moreover, GDPR and other privacy regulations prevent instructors from sharing class rosters, and online training offers no opportunities for lunches or happy hours — or even staying behind on break to talk to an instructor one to one — as in-person training would.

Attoe says Spyder Forensics trainers are encouraged to facilitate more social interaction as they might during a live class. “We’ll put out quizzes and polls, so some will be general questions about the class and review options, but sometimes we’ll throw in an odd question,” he said, “something that might generate a bit of humor or banter in the classroom.” Doing so, Attoe added, builds rapport and encourages people to talk to each other.

Part of putting students at ease is also helping to resolve any technical problems at the outset of class. Taking the time to do that sets them up for success. “It’s part of the learning process,” Attoe explained.

Future thinking

In an industry hungry for knowledge, said Attoe, adapting more classes for the online environment — along with informative, educational webinars — will still be important heading into 2021, as will continually reassessing platforms and message delivery.

Remote instruction could benefit from newer technologies, too. The FSI editorial described “virtual walkthroughs” of crime scenes using 360 [degree] video captured images with embedded content. Although the authors acknowledged students would have less exposure to practical skills such as contamination avoidance, scene control, and evidence recovery, the VR approach allowed educators to focus more on the “interpretative aspects of crime scene investigation,” including decision-making.

VR in education isn’t new — but a first-of-its-kind study extended the concept to digital forensics education. At the Digital Forensics Research Workshop (DFRWS), Courtney Hassenfeldt, a cybersecurity engineer and adjunct professor at the University of New Haven (UNHcFREG), presented “Exploring the Learning Efficacy of Digital Forensics Concepts and Bagging & Tagging of Digital Devices in Immersive Virtual Reality.”

The National Science Foundation-funded research included a hands-on laboratory exercise in bagging and tagging a crime scene with digital devices. To measure whether virtual reality could be valuable in the landscape of online digital forensics education — whether it could deliver instruction as effectively as in the real world — Hassenfeldt’s research team designed and developed an immersive VR experience.

Hosted on the Engage platform, what she called “the first openly available VR digital forensics education game” included a pre-recorded lecture and a lab. The lecture offered introductory concepts on multiple topics: types of evidence, methods and tools, forensic analysis software, hash values, and handling evidence at crime scene.

Fifty-seven study subjects were then randomly assigned to a VR group or a physical group, which both received the same content.

In the VR group, students learned from an avatar — the prerecorded professor — teaching from the screen, where slides coincided with the recorded audio. This group’s lab component consisted of a “case briefing” by a “CEO”. Then, participants completed a virtual on-scene investigation. They were brought to where their investigation would take place, asked to bag relevant items, and given mini ordering tasks to complete.

Participants were surveyed both before and following the two components to assess their knowledge in digital forensics concepts. While the participants’ scores didn’t significantly differ between the two groups, the VR participants completed their tasks more quickly.

The research also asked participants about their experiences. Ninety-four percent, said Hassenfeldt, said they felt like they were in the virtual room. Half reported no physical reactions to VR, though nearly 30 percent felt dizzy, lightheaded, and/or nauseated. Roughly the same proportions respectively agreed or disagreed that VR should be integrated into college courses.

The experimentation hasn’t ended there. Later in the year, Dr. Ibrahim Baggili posted on LinkedIn that the Connecticut Institute of Technology would be running what he called “the first laboratory exercise as part of our Intro to DFIR class on Twitch.”

There, participants “remote controlled” digital forensic investigator Andrew Mahr through a first person perspective in real time, deciding how to document the crime scene and solve the case.

The Twitch lab was a success. On the university’s Charger news blog, Baggili’s teaching assistant, Master’s degree candidate TJ Balon, was quoted as saying: “As we’ve been looking through their lab reports, it looks like we had a major success and the lesson was well received. We look forward to continuing to utilize modern technologies to aid in virtual learning.”

As any educator knows, a student’s ability to learn is optimized when they feel safe, supported, confident, and empowered. Whether they’re preparing for or enhancing their careers or further studies, their success hinges on their environments, relationships, instructional content, and educators’ own skill among many other factors.

Christa Miller is a Content Manager at Forensic Focus. She specializes in writing about technology and criminal justice, with particular interest in issues related to digital evidence and cyber law.

1 thought on “Teaching Digital Forensics During A Pandemic: Present And Future Strategies”

Leave a Comment