Towards Digital Forensics Pedagogical Framework

Abstract

Digital forensics education faces numerous challenges that hinder effective knowledge transfer to students. For instance, FAT file systems illustrations can be a protracted process in a practical session: hopping amongst FAT table, boot sector, root directory, and data area take long time. This is frustrating for students and arduous for the instructor. In this paper, we present a novel pedagogical framework for efficient digital forensic education. It is built using modular and flexible software architecture. This makes it simple to expand and include new topics. FAT file system forensic is implemented in the framework to verify its effectiveness first. Afterward, other topics such as different file systems (e.g., NTFS), operating system analysis, network, and memory forensics can be implemented. Most of the presented illustrations use RTF format for easier accessibility, zooming, and maintaining format when copied to word processors (e.g., Microsoft Word). The proposed framework should enhance and facilitate digital forensics education.