Innovative Learning in a Digital Forensics Laboratory: Tools and Techniques for Data Recovery

Abstract

Electronic evidence is an essential component in most legal trials of criminal activities, and digital forensics is therefore a crucial support for law enforcement investigations. For instance, a wide range of electronic devices contain Not AND (NAND) flash memory chips, and when a criminal leaves digital evidence on non-operational or locked systems, accessing this memory is crucial. Student acquisition of the necessary competences and skills associated with electronic devices, their basic principles, and the associated technologies can be provided by experimental training, as done with the optional Digital Forensics module included in the degree in Criminalistics: Forensic Sciences and Technologies offered by the University of Alcalá (Spain). This module equips students with the appropriate skills to extract, process, and authenticate evidence information using suitable tools. The purpose of this study was to investigate the effectiveness of experimental learning, deployed through laboratory digital forensic tasks. A literature review was conducted of novel data extraction and analysis tools and procedures as a guide to the design of data recovery tasks incorporating experimental learning. Drawing on student feedback, our results highlight positive learning outcomes for the students. It is concluded that powerful forensic image analysis freeware is capable of identifying elements, and practical tests involving JTAG/chip−off extraction and analysis yield favorable results. A proposal for future studies is to reduce the destructiveness of invasive extraction methods.