Committing the perfect crime: A teaching perspective

Document Type

Conference Proceeding


Curran Associates Inc.


School of Science




Carthy, L., Ovensen, E., Little, R., Sutherland, I. & Read, H. (2018 Committing the perfect crime: A teaching perspective. In A. Jøsang (Ed.), Proceedings of the 17th European Conference on Information Warfare and Security: ECCWS 2018 (pp. 87-95). Academic Conferences and Publishing International Limited.


There are a number of important aspects to training as a digital forensics investigator. In addition to interest and a strong sense of ethics, the role requires an understanding of practice, procedure, technology and law. It is also important to understand all aspects of processing, analysing and preparing a case, from a crime scene to presentation in court. The next generation of forensic practitioners require exposure to relevant learning material to make the transition from academia to the workforce. In terms of learning material, this can best be achieved by providing students with realistic case material to analyse and investigate. Still, creating these controlled environment scenarios can be challenging; the purchase and use of second-hand hard disk drives may raise a number of legal issues, in particular related to data protection legislation. Furthermore, obtaining realistic material may also conflict with University ethical practices and procedures, as students may be exposed to inappropriate material (Jones et al., 2010). The creation of a training scenario may require several hours of teaching staff effort to devise; whilst existing forensic images (e.g. CFReDS 2016, Digital Corpora 2017) often have answers posted on line. This paper describes an alternative process whereby students from different countries (Norway and the USA) collaborate internationally to learn about forensic investigation by creating scenarios and developing educational tools for other student groups. The process of documenting the case, creating a realistic evidence trail, and mitigating errors (e.g. server crashes, typographical errors in emails, etc) provides a greater understanding of digital evidence, root cause analysis and file provenance. The experience provides a unique learning opportunity for the students involved. Moreover, it provides more challenging assessment scenarios for those students investigating the case, as different time zones and cultural norms are involved. Furthermore, this paper highlights the advantages of international collaboration in creating teaching material and sharing knowledge, and proposes recommendations for future work.

Access Rights

subscription content