No one disputes the growing need for digital forensics experts and services. Cybercrime and digital forensics topics appear daily in mainstream news. Each story highlights a trend or single high-profi le case in which digital forensics played a prominent role.

Demand for digital forensics expertise is high, and in a push to supply it, many colleges and universities have created courses, certificates, and degree programmes. In doing so, however, they may be focusing on the wrong thing: the popularity of digital forensics. This is evident in the way that many of them merely replace or adapt existing computer science courses.

To remain competitive in the long run – to continue to profit from digital forensics curricula – academic institutions must be able to graduate properly educated and trained examiners who fulfill the need for their expertise. Thus digital forensics curriculum designers must answer a number of critical questions:

• What should the degree include? What is the balance between theory and practice?
• What is the scope – the balance between breadth and depth?
• What kinds of facilities and equipment are necessary?
• Who should teach; should teachers be practitioners?
• How to ensure graduates have the skills they need at the end of four years?
• How to ensure consistency across institutions?

The balance between theory and practice
Industry recruiters want candidates, preferably with experience and/or certifications on tools like EnCase or FTK, whom they can put to work immediately. Indeed, hiring managers have difficulty finding candidates who have practical experience dealing with hardware either inside or outside of their courses – much less hands-on practical experience with computer forensic examinations. This is to some degree, a chicken and egg situation where candidates can’t get practical experience because nobody will give them a job for lack of experience; the obvious answer is for them to get it during their education.

Yet students are at university for an education: to learn the concepts underlying the tools. Too much practice and the programme becomes little more than training; too much theory, and the student’s education becomes irrelevant to the industry. The right mix creates practitioners who understand enough of their discipline to respond to change when it happens – if not anticipate it beforehand… see issue 5 for the rest of this article - subscribe now!

The full article appears in Issue 5 of Digital Forensics Magazine, published 1st Nov 2010. You must log in with a valid subscription to read on...