Acquiring and Analysing Digital Evidence - a Teaching and Learning Experience in Class

The advancement of Information and Communication Technology (ICT) offers positive and negative impacts in our daily life today. Criminals too leverage on sophisticated ICT in their modus operandi. Hence, digital evidences are abundant to be acquired and analysed as part of investigation, today. Two homegrown tools i.e. PenDua and Kloner are used for digital evidence acquisition tool while FTK and Autopsy are among tools applied for analysis of the evidences. Various artifacts are used as evidences of some made-up crime cases. The whole exercise is compiled as a learning package that can be a good exposure for beginners of Digital Evidence Forensics learners. We have tested the usage of this learning package with 120 students of a Digital Evidence Forensic class for 3 semesters. Majority of the students found that they enjoyed experiencing the hands-on to learn the proper procedure of acquiring and analyzing digital evidence, usage of several popular digital forensics tool and producing proper report. The made-up of real cases make the exercise interesting, appreciated by the students and enhance their understanding.