Illinois using interdisciplinary approach in digital forensics course

Mike Koon

As more and more evidence presented in a courtroom is from computers and smart phones, digital forensics is growing in significance, both in criminal and civil cases. But as University of Illinois students are finding out, collecting that evidence is not as easy as portrayed on popular TV crime shows.

To that end the College of Law and the Department of Computer Science have teamed to offer a course in digital forensics, which gives students exposure to both the technical and legal side in addition to other topics crucial to collecting and presenting digital evidence.

 This semester’s introductory course is just the beginning to the development of a digital forensics curriculum, which is being partially funded by the National Science Foundation.

“Teaching digital forensics is intrinsically an interdisciplinary field,” said Jay Kesan a professor from the College of Law, who is teaming with five other professors to co-teach the course. “You have to be aware of not only the digital technology, but also what you can and cannot do legally in trying to develop the evidence. You have to be schooled in computers, communication and the law.”

“Digital forensics is the science of providing evidence when that evidence is based on information,” said Roy Campbell, a professor in computer science who directs the course. “As it relates to evidence supplied in court, it needs to be obtained in the correct way, preserved in the correct way and presented so that the court can understand it.”

Although offering a digital forensics major may be the eventual outcome, in the short term, the team hopes to expand the instruction of digital forensics into a full program with a certificate granted for completing it. That team in addition to Campbell and Kesan, includes professors Mosooda Bashir from Library and Information Science, Anna-Maria Marshall from Sociology, and Frank Nekrasz from Accountancy along with Faisal Hasan from the Information Trust Institute, and teaching assistant Anthony Lang from computer science.

“We are developing what we hope will be a national standard for developing a digital forensics curriculum (which includes writing a book on the subject),” Kesan said. “It’s not just teaching our students, but it’s using the University of Illinois as a course development laboratory.”

Campbell says that although Illinois isn’t unique in its development of a digital forensics program, the fact that it is interdisciplinary sets it apart from most.

“It provides a balance,” he said. “Even though it’s a computer science course, the objective is to prove your case in a court of law, which has juries who need to be persuaded. Having that mixture of disciplines makes it much more exciting and interesting.”

The class consists of 50 students from both law and computer science and, according to Campbell, is designed to provide those students with a good understanding of the issues in gathering digital evidence, including the recovery of deleted files, how to copy it and authenticate how it was obtained, and how to describe it in a courtroom or other legal setting.

“There’s a world of difference between looking at the evidence from simply a technical point of view compared to looking at it from sort of the Sherlock Holmes viewpoint of what to glean from what someone has been doing on his computer?” Campbell said.

“It’s nothing like we see on TV,” said Felipe Mavromatis, a second-year law student. “We just did a group report where we spent four or five hours looking at text files and logs. It’s very different than what you see on CSI.”

In addition to gathering and presenting evidence, students are gaining understanding of the psychology of hackers and cyber offenders, HIPAA laws, FERPA, and the Computer Flaw and Abuse Act as well as the sociological aspects of digital forensics. Beyond the legal side, it includes protecting the confidentiality and integrity of data and determining the authenticity of archived documents, which are useful in library science.

“As we use digital technologies, law enforcement relies on this technology more all the time,” Kesan said. “However, computer forensics is playing a big role in ordinary civil disputes, accounting practices, security fraud, company bankruptcy and patent infringement.”

“This is really the only class where I have had exposure to the psychology of crime, how to be an effective expert witness by talking about technical terms in the court room, fraud in accounting, and exposure to the tools that are used in the industry,” said Veer Dedhia, an electrical computer and engineering major minoring in computer science and who plans to enter the field of cybersecurity.

Because the topics are presented in just one semester, it is designed to just scratch the surface of all the aspects of digital forensics.

“This is an introductory course and meant to be a teaser to get students interested in additional courses,” Campbell said. “We found that law students were actually good about thinking like computer scientists even though they don’t have much formal instruction on the topic. Once they’re hooked, we hope they’ll use it as a pathway to learn enough computer science to be an expert in digital forensics.”

Campbell adds the science is only going to expand, but because the technology is changing rapidly, especially in the world of smart phones, the team is taking its time in mapping out the instructional program.

Students from both law and engineering find the range of topics valuable.

 “I have gained a more broad understanding of what’s necessary not only from a legal perspective, but about the technical background as well,” Mavromatis said. “Judges and juries don’t often know the technical side so in order to be a more effective attorney, you need that understanding to best represent your client.”