Towards a Computer Forensics Curriculum

1. Towards a Computer Forensics Curriculum Alastair Irons Northumbria University

2. Objectives • Set the scene • Start discussions on curriculum • Introduce Workshop 1

3. Computer Forensics as a Subject • As a branch of forensic science • As a branch of computer science • a sub discipline of computer science • A relative discipline of computer security • As an interdisciplinary subject • For example linked to computer science, forensic science, law and criminology • As a discipline in its own right

4. Purpose of Computer Forensics Programmes • To develop skilled professionals in computer forensics – in order to address employability? • To develop a bottom up or top down approach to a specific branch of computing • To provide a course which will attract different students to computing schools? • To contextualise computer science (see Irons and Laing 2006) ?

5. What makes a Computer Forensics Programme • No generally accepted curriculum • No benchmark • No professional body syllabus • Undergraduate programmes • Specialist module in final year ? • Thread running through all levels (20 points per level) • Development of a practical and theoretical body of knowledge from year 1 to final year (20, 40, 40 plus project) • Role of joint programmes – criminology or forensic science or law ??? • Postgraduate programmes • Specialist or generalist ? • Stand alone or linked to security ?

6. Towards a Computer Forensics Curriculum • Technical expectations and requirements • Practical application • Balance between theory and practice • Theoretical underpinning • different to computer science ? (explored in workshop 2) • Legal and ethical requirements ? • Particular pedagogic requirements • Problem based learning, authentic learning ??? • Specialist subject based research • Resource requirements • Should curriculum be linked to accreditation and licence to practice

7. Further Reading • Irons, A.D. Laing, C., and Anderson, P., (2006) ‘Computer Forensics – a Case Study on the Impact of New Technology on Informatics Education’, paper presented at Informatics Education Europe, Montpelier, France, November 8 – 9, 2006 • Dornseif, M., Freiling, F. C., Holz, T., Irons, A. D., Laing, C., Mink, M., and Anderson P., (2006) ‘Comparative Study of Teaching Forensics at a University Degree Level’, IMF 2006, International Conference on IT-Incident Management & IT-Forensics, October 18 - 19, 2006 Stuttgart, Germany • Irons, A. D., Laing, C., Anderson, P., (2006) Pedagogic Innovation in Teaching Computer Forensics, paper presented at 7th Annual HE Academy Conference for Subject Centre for Information and Computer Sciences, Trinity College, Dublin, 29 – 31st August 2006 • Irons, A. D., Laing, C., Dornseif, M., Freiling, F., Anderson, P., Holz, T., & Mink, M., (2006) “Developing Computer Forensics Programmes: An International Perspective”, 1st Conference on Advances in Computer Security and Forensics (ACSF), School of Computing and Mathematical Sciences, Liverpool John Moores University, Liverpool, UK 13-14 July, 2006 • Staley, A. B., Inch, S., and Shapeero, M., (2006) ‘From CSI to classroom: developing a computer forensics degree program’, in Information Systems ControlJournal, pp 39 – 43

8. Workshop 1What makes a computer forensics programme a computer forensics programme ? • What do we need to cover in a computer forensics curriculum ? • Are there a minimum number of computer forensics credits required before an award can be titled computer forensics ? • Is there a minimum expectation in the computer forensics skill-set, application and / or knowledge ? • What should the balance between theory and application be ? • Flexibility to embrace advances in digital forensics ? • What chapters would you expect to have in a textbook covering computer forensics ?