Teaching Computer Forensics at a Distance HE Academy Workshop on the Teaching of Computer Forensics University of Glamorgan, 27 November 2008 Blaine Price Computing Department Computer Forensics Course Team Chair

27 Nov 2008Blaine Price, Open University2 Outline Background to OU and Course Teaching Content Assessement Challenges for Distance Teaching Results of First Cohort Questions and Feedback

27 Nov 2008Blaine Price, Open University3 Background OU postgraduate computing teaching methods Single (new) course introducing computer forensics No face-to-face tuition, no labs, no licensed software 24 Weeks (6-8 hours/week) including time to complete assessement

27 Nov 2008Blaine Price, Open University4 Content 3 weeks intro to Forensics and Investigations 4 weeks on Legal System and laws relating to Forensics and Investigations (Civil and Criminal) 6 weeks on techniques (Disk Imaging, Carving, Internet and Network Forensics) 3 weeks on research and Forensic Readiness Planning

27 Nov 2008Blaine Price, Open University5 Assessment Continuous Assessment: 3 assignments 10%, 15% and 25% of final grade resp. –Each requires long prose answers –Final assignment is a Forensic report + contemporaneous notes End of Course report, FRP Design –50% of final grade –2,500 words plus references and appendices –double-marked No exam

27 Nov 2008Blaine Price, Open University6 Challenges for Distance Teaching Software: no lab, can’t afford licensed software! –Helix shipped as main software, Demo version of FTK for forensic analysis exercises (limited to 5,000 files), assortment of free/Internet software Support: no lab or f-f tuition –Limited telephone/ support from tutor –Peer and tutor support in course forum –Can’t support technical problems such as disk imaging

27 Nov 2008Blaine Price, Open University7 Results of First Cohort 120 students started course 116 submitted first assignment 106 submitted second assignment 86 submitted third assignment 77 submitted final report Record (low) retention! Record (low) grades (2 distinction, 18 Merit) with grade boundaries at Senate minimum

27 Nov 2008Blaine Price, Open University8 Possible Explanations CSI/Spooks/NCIS effect Techies put off by report writing Non-techies put off by hands-on forensics No Exam = easy option? (not!) Part-time forensics has low retention elsewhere? Poor teaching/course design?

27 Nov 2008Blaine Price, Open University9 Future Course will be offered twice a year, second cohort just started, half size of first cohort General IT Law course to be developed next, then either Ethical Hacking or Advanced Forensics Questions? Feedback?