Campus Experts Developing a Digital Forensics Undergraduate Curriculum

PI Roy Campbell and Co-PI Masooda Bashir at the recent workshop on Digital Forensics.

May 31, 2013

Want to become a digital detective? There's a new course on campus this fall: CS 498, Special Topics. Despite the course's nondescript rubric, it invites students from a number of disciplines, including computer science, criminal justice, and even law, to investigate the exciting, up-and-coming field of Digital Forensics.

The Information Trust Institute (ITI) at the University of Illinois recently received a 4-year National Science Foundation grant to develop an undergraduate curriculum which addresses the multi-disciplinary nature of digital forensics. Program in Digital Forensics (PDF) will tap the skills and knowledge of experts in the field, not only on this campus, but from across the nation, in order to standardize the curricula in this emerging field of study. At PDF's introductory event on May 21st, the Digital Forensics Workshop, some of these experts began to address the scope of what digital forensics should teach and vet the resources being developed.

Digital Forensics focuses on the recovery of data from digital devices as part of criminal and civil investigations by law enforcement agencies. Because it is such a rapidly growing branch of forensics, the need for a skilled technical workforce is important to meet the needs of the nation. However, while several universities offer programs, even the few that exist across the nation differ widely in what is taught. Masooda Bashir, one of the Co PIs on the project, notes that for digital forensics, as for each new field that emerges, such as computer science 20 years ago, educators must determine what should be taught. "Some of the first questions," according to Bashir, "are: 'What do we teach people about this? What are the important topics?'"

Bashir stresses the importance of ensuring that someone who takes an introductory course in digital forensics at one university, such as Illinois, learns most of the same things taught at other universities: "One of the things that we think is a problem or an issue to work on is that there is a lack of standardization. So that's one of our main missions, to bring about standardized curriculum for undergraduate digital forensics. And NSF thought that the University of Illinois is placed well to do this."

According to Bashir, many schools teach digital forensics purely as computer science. However, what makes Illinois' project unique is its emphasis on multi-disciplinary collaboration. It not only draws on experts from Computer Science, (PI Roy Campbell, who specializes in cyber security) and Computer Engineering, but it includes experts from a variety of other key disciplines to ensure that the curriculum developed adequately addresses the truly multi-disciplinary aspect of digital forensics.

Jay Kesan (right) discusses digital forensics with another participant during the recent workshop.

For example, Law Professor Jay Kesan will be covering the law and technology aspects of digital forensics, including Fourth Amendment protections against unreasonable searches and seizures. evidentiary issues such as preservation of evidence and chain of custody, online privacy laws such as HIPPA and FERPA, cybercrime statues, and e-discovery in civil litigation.

Kesan hopes the digital forensics curriculum the PDF develops will "empower our students and give them the intellectual capital that they need to succeed in this field and to give them more professional choices as they advance in their careers."

Kesan felt the project's recent workshop was very well received: "We made an impact by bringing together so many key players engaged in digital forensic activities, including other educators, government experts, software experts, and professionals from private sector companies offering digital forensic services."

PDF includes Anna Marshall, Head of the Sociology Department, who will address criminal justice. Just as investigators in other types of forensics, such as homicide, must preserve the evidence to ensure that it is admissible in court, scientists trained in digital forensics must also learn how to collect evidence appropriately. Another aspect of criminal justice is to ensure that the rights of the user are considered.

Counter clockwise: Lizanne DeStefano and Frank Nekrasz listen to the keynote speaker during the recent Digital Forensics Workshop.

Internet fraud has become an increasingly commonplace issue in the digital world. Frank Nekrasz from Accounting will provide an overview of fraud examination and business-related frauds (e.g., financial statement fraud, embezzlement, etc.). Since digital forensic experts are used in fraud examination engagements, the objective of Nekrasz's portion of the course is to give students a context for understanding the nature and extent of fraud in the U.S.; he will also give the students an overview of Benford's Law—a digit-analysis technique used to identify fraudulent business transactions.

Regarding the project, Nekrasz adds, "I hope the impact will include growing a digital forensics minor or certificate program. There is a huge demand for digital forensic professionals and seeing Illinois become a provider of these professionals in the marketplace would be rewarding."

Addressing the effectiveness of the course and PDF as a whole is Co-PI Lizanne DeStefano, Professor in Educational Psychology and Director of I-STEM, who is an expert in educational assessment.

Another member of the project is David Nicol, Director of the ITI. With its cyber security focus, ITI is the ideal home for this kind of project because it's not an academic unit, but a multi-disciplinary research unit. No one academic unit is able to claim sole ownership, thus it places the project under more of a multi-disciplinary umbrella.

The expertise that Masooda Bashir, with her background in computer science, math, and psychology brings to the project is trying to understand how the cyber criminal's mind works: "What I like to look at is the psychological aspects of these cyber criminals. What is their motivation? How did they go about it? Where might they be from? Which country or origin or cultural background? Female or male? What types of things have to happen? So a lot of it is the same as other types of crimes, it's just that now, it's in a very different medium, right? It's digital."

The motivation of cybercriminals seems to be a key element. For some, hacking a key institution, such as the Pentagon, can become some kind of game or challenge:

"For some cybercriminals, they just want to prove that they can do it. 'Wow, I went through the Department of Defense! Look how bad their security is!' It's more of a glory type thing or showing off to their peers—other hackers. They usually belong in this kind of circle, and they want to show off."

Digital Forensics experts at one of the breakout sessions during the recent Digital Forensics Workshop.

Bashir indicates that another motive is financial gain. A large number of cybercrimes involve money. She reports that "Banks now allow for a certain amount to be taken, stolen electronically, because there is just no way. By the time the catch up with it, they stop it, but they have already lost a certain amount."

Bashir says that cybercrime is an ongoing problem because more aspects of our lives are online now— digital. With so much of our lives on Facebook, hackers can easily guess things about us: "So lots of these layers of our social environment are changing: the way we communicate; where we keep the information; it's all digital."

This increasing reliance on the digital world—with its corresponding emergence of cybercrime—underscores the importance of digital forensics, and their program: "So I think that it's very timely that we have this as an area of study," adds Bashir. Students still need all these other basic core disciplines, like computer science and mathematics. But for them to think in this particular field, they'll have to think in a multi-disciplinary way, and they'll have to think as a detective almost."

There's a catchy little term, complete with alliteration, that seems to be in vogue nowadays (Yes, I googled it) when discussing digital forensic scientists—digital detectives. Bashir finds the term to be extremely apropos: "Yeah, it is kind of that way, where they still have to do detective work; it's just that they're in a different environment: a digital environment."

Story by Elizabeth Innes, Communications Specialist, I-STEM Education Initiative.
More: Funded, Undergrad Education Reform, 2013

Professor Bill Sanders, Director of the Coordinated Science Lab, speaks to workshop participants about the importance of intensive Digital Forensics education.