by Si Biles, co-host of the Forensic Focus podcast
Warwick University hosted the 18th Teaching Digital Forensics Workshop on Wednesday 23rd November 2022. Largely owing to the big “C”, the last in-person event was back in 2019. As you’d expect from the title, this is an academic conference in the UK that aims to bring together those teaching or researching digital forensics with the objectives of sharing ideas and techniques, fostering collaboration and sharing some of the interesting things that people are working on. It also acts as an opportunity for departments to advertise their needs in the way of supervisors, markers, guest speakers and the like.
Availability of Digital Forensics Courses
Our opening lecture really highlighted why this is so important – Dr Harjinder Lallie, from our hosts, Warwick[1], began proceedings by running down the current “state of the nation” as it stands with regard to Digital Forensics courses that are available. His research on the matter is a little disturbing, as there has been a significant reduction in the number of available courses that contain forensics in the title in any way. As it stands at time of writing, there are 14 Digital Forensics degrees. Of course, there are still going to be some courses where a module of forensics crops up (Warwick is one of these – the Undergraduate course had an IRDF course included – and there are 25 of these “other” courses) where the title is misleading. But we’re talking about proper hard-core Digital Forensics here – you know, the sort of thing that we actually have a profession in!
I’m aware that this number is likely to change – not least because of the recent appointment of Dr Sarah Morris to Southampton as Professor of Digital Forensics extending their offering – but we’ll come back to Sarah in a bit, as she gave a great talk too … In reality, this means that the representation of nine universities in the room probably covered a good proportion of the aforementioned course providers …
The Dark Web
Next up was Dr Mohamed Chahine Ghanem of London Metropolitan University. Dr Ghanem numbers some of the Met Police amongst his students and makes good use of the knowledge that they bring (as does he from his previous life in Law Enforcement) to research in the Dark Web. He gave us a very interesting talk around the artifacts available from accessing assorted items on the dark web using the Tor Browser on a selection of devices and the success (or otherwise) of tools to hide said traces. Great work – that gave a few of us who’ve filled out ethical approval forms palpitations – but great work none the less!
Teaching Digital Forensics
Dr Adrian Winckles from Anglia Ruskin University followed. Adrian’s name is one that I’ve seen many a time on e-mails from the BCS Cybercrime Forensics Specialist Group but only met for the first time in person at this event. Adrian gave an interesting talk on his ideas surrounding the creation of forensic images for teaching. Anyone who does teach forensics knows the pain joy of creating scenarios and images to give to students. His raiding of his junk draw provided an intriguing idea of how to create some – using some rather outdated equipment (iPod Nano and DVR – both FAT32 and some weird smart watch) to create a slightly disturbing scenario with multiple devices to investigate [albeit blowing up the DVR in the process!].
Continuing on the pedagogical path, aforementioned Professor Morris took us through her teaching scenarios. Anyone who has knowledge of “The Twisted Pair” will be happy to see that their legacy lives on. I am honestly in awe of the amount of effort that has been put in in creating such an immersive environment and experience for the students. We all love a bit of cheese with our scenarios – we deal with the real world far too much in DF and it often is not the nicest of worlds – but the immersive world created had me laughing out loud. A particular favourite was a virtual helpdesk call that kept you on hold … I was wondering if it would ever get answered! The use of generated speech, cartoon characters and modular building blocks means that immense variation is possible as the world grows -but with reduced effort for each subsequent creation.
A break for lunch – the usual academic conference fare of sandwiches and pizza, fine by all measures, but hardly ground-breaking or Michelin star winning. The coffee was lousy though – but we’re there for enriching our minds, not our bodies!
Digital Forensic Tool User Interface
In the always difficult after lunch slot, Dr Paul Stephens and Danny Werb from Canterbury Christ Church University did a fabulous double act – rudely interrupted by the fire alarm – discussing “Is the Digital Forensic Tool User Interface Broken?” Personally, I think that we can answer this with a resounding yes, but that doesn’t actually solve the problem. Danny’s research into VR-based interfaces drawing from gaming (“Heavy Rain”) and film (“Minority Report”) postulates a more interactive environment that allows for a more joined up investigation approach rather than being heavily flat UI and bogged down with HEX. It’s a very interesting concept and it certainly made for a very interesting presentation. I can’t deny that there are plenty of awful UIs in the industry, but I’m not sure I fancy doing my job in VR! In any case, any discussion of the topic is most valid and will push us forward in interesting ways!
Women in Cyber Fields
CyberWomen@Warwick hosted their very own, and very successful, conference earlier this year – Sophie Powell and Sarah Tipper (two Warwick BSc Cyber Security students I have been lucky enough to have had the pleasure of teaching) gave an entertaining talk through what their experiences were from the process, what they’ve taken away from it and also the possibility of scaling it out to other Universities to help advance Women in Cyber fields. They’re becoming quite accomplished speakers and other students would do well to take them up on their offer of advice and assistance should it be required in similar events. (If – in reading this – this sounds like it may relate to you, then feel free to drop me a line to si@forensicfocus.com and I’ll make appropriate introductions.)
A brief break from some more of that “coffee” and we were into the home straight – as always, the breaks are a great opportunity to network with the other attendees – there seems to be a bit of a people deficit in the field, as there was a little in the way of poaching people as markers and guest lecturers to fill out various department’s staffing…
USB Experiments
Damola Lawal (a PhD candidate from Greenwich) talked to us about his experimental work with regard to some very interesting USB devices – research which has led to a very healthy level of paranoia in him regarding borrowing other people’s USB cables. Very interesting findings regarding the evidence (or lack of it) left behind from the surreptitious use of devices like the “Rubber Ducky” and the O.MG cable. I suspect that this could have filled a much longer slot, and I think a fair few of us would have been very interested to listen to it.
Digital Forensics Project Day
We come, at last, to the closing talk given by a few more Warwick students, this time from the MSc module. The module contains a “Digital Forensics Project Day” – a day-long group project with a task to solve accounting for 20% of the module mark. It’s an interesting task for them to work their way through, and they certainly seem to have valued it as part of their learning experience. The main speaker, Sarah Aktaa, is now a teaching fellow at Warwick, having gained her MSc earlier this year – she was joined by two other students who are in the current cohort.
It was a great opportunity to get together with others in the field and to have an opportunity to hear about the ways that we’re addressing the challenges that we’re all facing. Good to see old friends, and to make some new ones too. I look forward to next year’s event – as soon as I know where and when it is, I’ll share it here!
To see the list of speakers and learn more about them, click here.
[1] It should be noted for transparency, I left Warwick University at the beginning of this year where I had been teaching Digital Forensics amongst other things …
