udfp1556-72811556-7346journal of digital forensic practice ... · computer forensics labs, hiring...

Journal of Digital Forensic Practice, 3:11–22, 2010Copyright © Taylor & Francis Group, LLCISSN: 1556-7281 print / 1556-7346 online DOI: 10.1080/15567280903357771

11

UDFP1556-72811556-7346Journal of Digital Forensic Practice, Vol. 3, No. 1, January-March 2009: pp. 0–0Journal of Digital Forensic Practice ARTICLE

An Online Graduate Programin Digital Investigation Management:

Pedagogy and OverviewM.S. Program in Digital Investigation ManagementG. C. Kessler and D. A. HaggertyGary C. Kessler1,2, and

Don A. Haggerty1

1Champlain College, 163 S. Willard Street, Burlington, Vermont 05401, USA2Edith Cowan University, Mt. Lawley, Western Australia

Address correspondence to Gary C. Kessler, Champlain College, 163 S. Willard St., Burlington, VT 05401, USA. E-mail: [email protected]

ABSTRACT Although still a relatively new undergraduate course of study atmost colleges and universities, specialized degree programs in computer foren-sics and digital investigations are now becoming available at the graduate level.There appear to be two divergent educational paths for graduate-level educa-tion in this field, namely, technology and management. This article describesChamplain College’s online master of science degree program in Digital Inves-tigation Management. The curriculum is described, along with the learningtheories and pedagogies that provide the guiding principles for course design.Particular attention is paid to the central pedagogic design of integrated reflec-tive practice. Issues related to the online learning environment and adult learnersare also presented.

KEYWORDS computer forensics education, computer forensics management, digitalforensics education, digital forensics management, integrated reflective practice, onlineeducation

INTRODUCTIONAlthough an increasing number of colleges and universities around the

globe have started to offer programs in computer forensics and digital investi-gations, this is still a relatively new discipline in undergraduate education.Interestingly, though most of the programs in the United States were devel-oped largely in response to requirements of the law enforcement communityand to fill the needs reported in several national studies [1–3], most of thegrowing needs for this skill set come from private sector organizations provid-ing data recovery, electronic discovery (e-discovery), incident response, policyauditing, and third-party forensic analysis services.

As the discipline matures, the educational needs have come into sharperfocus and several guidelines have started to appear [4, 5]. The need for thenext generation of leaders has also resulted in the need for advanced, gradu-ate-level education in digital forensics, and definitions [4, 5] and actual pro-grams [6–8] are already being offered. The graduate proposals to date,however, are largely steeped in technology and computer science, preparing

Downloaded By: [Kessler, Gary C.] At: 16:07 21 March 2010

G. C. Kessler and D. A. Haggerty 12

students for more rigorous research and developmentin the technical problems related to computer foren-sics, such as the need for more and better examina-tion and reporting tools, coping with whole diskencryption, acquiring data from cellular telephones andother mobile devices, and combating anti-forensicstools. Students in these technical graduate programsare those who will be designing next-generationcomputer forensics analysis tools, techniques, andprocesses or shifting into computer forensics fromanother discipline.

Champlain College’s Computer & Digital Forensics(C&DF) undergraduate degree and academic certifi-cate programs started in 2003 and have been previ-ously described [9, 10]. As the college reviewed theneed for graduate education, it was found that anothercritical need in digital forensics was not beingaddressed by advanced education—namely, manage-ment issues related to overseeing large cases, runningcomputer forensics labs, hiring staff, conductingresearch, etc. [11].

The following section will discuss a proposed grad-uate degree program in Digital Investigation Manage-ment (DIM). The next section will present thepedagogic issues related to this program designed foradult students with experience in the field. The finalsection will provide some concluding comments.

Kessler and Haggerty [11] provided an early over-view of the DIM program as originally proposed anddesigned in 2007. This article provides a more currentdescription of the program as implemented after tak-ing into account comments by colleagues and coursedevelopers.

THE M.S. DIM CURRICULUMThis section will describe the M.S. degree program

in Digital Investigation Management. The first partwill present some of the philosophical underpinningsof the program and the second part will describe theindividual courses.

Curriculum PhilosophyIn 2002, Champlain College recognized the

national and global insufficiency of computerforensics practitioners and responded with anundergraduate degree program to educate profes-sionals in this growing field. Our undergraduate

C&DF program started on campus in 2003 and hasbeen offered online since 2004. Since that time, thecollege has focused on the undergraduate curricu-lum and the requirements for a B.S. degree in thisfield.

Stambaugh et al. [3], one of the seminal papersthat convinced the original curriculum designers thatsuch a program was necessary, identified ten criticalissues for local and state law enforcement withrespect to computer crime: public awareness, datareporting, uniform training and certification, man-agement assistance for on-site electronic crime taskforces, updated laws, cooperation with high-techindustry, special research and publications, manage-ment awareness and support, investigative and foren-sics tools, and structuring a computer crime unit. By2006, discussions with colleagues and practitioners inboth the private and public sectors suggested thatmost of these critical issues remain open or, at least,inadequately addressed. Most of the open issues,however, are not just about technology or personnel;all of these issues can be addressed and, to a largepart, resolved through appropriate long-term man-agement and policy creation [12]. But just as com-puter forensics and digital investigations requirespecialized training and education, the managementnecessary to address these issues is also specialized.Most individuals running electronic or high-techcrime units, however, are law enforcement officialswho have risen through the ranks of law enforcementas digital investigators but who, largely, do not havethis type of specialized management training. Privatesector digital evidence practices are also staffed by alarge number of former law enforcement computerforensics examiners.

Discussions with our undergraduate students (manyof whom are already experienced examiners), outsidepractitioners, organizations hiring computer forensicsexaminers, potential students, other industry expertsand academics, and our program’s advisory board con-vinced the program designers that the lack of a man-agement focus in computer forensics was a growinggap and critical need in the field in both the privateand public sectors. In addition, a management per-spective is ideally suited to graduate-level education;indeed, many examiners noted that their path forcareer advancement was best served by obtaining anadvanced degree that would enable them to move intoa management role.


13 M.S. Program in Digital Investigation Management

Champlain College already had Master’s in Busi-ness Administration (MBA) and M.S. in ManagingInnovation and Information Technology (MIIT)degree programs when design of the M.S. DIM pro-gram commenced in 2005. The synergies realized bycoupling the experience with our undergraduateC&DF program and our graduate managementprograms made the offering of a graduate manage-ment degree in computer forensics seem like a naturalnext step.

M.S. DIM CoursesThe M.S. DIM curriculum is a 42-credit course of

study, comprising 14 three-credit courses (Table 1). Sixof these courses are taken from the existing MBA andMIIT programs, and provide breadth to the M.S. DIMmanagement study. The remaining eight courses weredeveloped for this program, although several could beused in other programs.

The courses comprising the M.S. DIM curriculumare described in more detail in the paragraphs below:

• Integrated and Reflective Practice (MBA 500): Afirst-term course that provides the basis of both thephilosophy and the professional development per-spective used in all subsequent courses. Studentscomplete a thorough and multidimensional self-assessment that culminates in a personal learningroad map to guide their journey through the entiregraduate program. The emphasis of the content is

on the importance of work practice and experienceas a basis for management development and on theuse of experience for personal and organizationallearning. Specific topic areas include learning style,action learning, dialogue, communication, personal-ity type, and team communication. Short case stud-ies will also address the integration of learningthrough several areas of practice. This course sets thestage for subsequent courses that are grounded in anexperientially based learning process while introduc-ing the integrated content areas. (Integrated reflec-tive practice is a fundamental pedagogy for theprogram and is described in more detail below.)

• The Practice of Digital Investigations (DIM 500):The foundation for this program of study, thiscourse introduces the principles that are essential tothe management of digital investigations, providinga framework that includes technical, legal, and man-agerial issues. Students will examine the mission ofdigital investigations from the various perspectivesof the public and private sectors, including digitalforensics in support of activities ranging from inter-nal corporate investigations, responses to informa-tion security incidents, and policy auditing to third-party investigations, criminal investigations, andanti-terrorism information gathering—and discussingthe imperatives of each. As relevant, the impact ofinternational and cultural issues, as well as geopoli-tics, will be an essential part of class discussion. Amoral, ethical, and legal framework will also beexplored and developed, which can be used as a

TABLE 1 M.S. DIM curriculum

Course number Course name Prerequisites

MBA 500 Integrated and Reflective Practice1 NoneDIM 500 Practice of Digital Investigations1 NoneMBA 525 Process Improvement and Operations MBA 500, 15 cr.MIT 505 Project Management MBA 500 or MIT 500MIT 525 Financial Decision Making for Mgmt. MBA 500 or MIT 500MIT 530 IT Security and Strategy MBA 500 or MIT 500MIT 550 Reflective Leadership & Planned Change MBA 500 or MIT 500DIM 530 Legal Aspects of Digital Investigations DIM 500DIM 540 Current Topics in Dig. Inv. Techniques DIM 500DIM 550 Laboratory Operation and Accreditation DIM 500, MIT 530DIM 560 Digital Investigations for Civil Litigation DIM 500DIM 570 Research Methodology MBA 500 or DIM 500DIM 580 Legal Issues for Management MBA 500 or DIM 500DIM 590 Integrative Capstone Project 36 cr.

1DIM 500 and MBA 500 are the first courses taken in the program.



template for future courses. The capacity to makedecisions based on organizational and personal val-ues with which to pursue organizational goals willbe explored.

• Process Improvement and Operations (MBA525): This course approaches an organization’soperations and processes from both the initialdesign and continuous improvement perspective.Students will develop the ability to define, design,and improve business processes, something nowconsidered to be one of the most frequently citedskills for today’s workplace. Special attention will begiven to the linkage between operational and pro-cess improvement metrics to those based uponfinancial, economic, and accounting information.This linkage cannot be overemphasized becauseskills developed in this course provide a foundationfor economic modeling and planning. The sum ofthis will help define models of broad and optimizedorganizational performance measures such as score-card-type approaches. Among the areas of practiceincluded are the governance of financial resources,the innovative use of operational data, and the eco-nomics of improvement programs.

• Project Management (MIT 505): This course isdesigned to introduce a systematic process for plan-ning, organizing, and controlling projects based ona practical methodology for completing projectsmore quickly with fewer problems. Students willdevelop and apply a framework within which to bet-ter manage projects, exercise both hard and softproject management skills, and affect organizationalculture toward acceptance of project management.Areas of emphasis include an array of principles,methods, tools, and techniques that can be appliedto any type or size of project and in any organiza-tion. Course content is aligned with the ProjectManagement Institute (PMI) processes and knowl-edge areas but will center on the process of projectmanagement. The course provides a perspective thatis integrative, first, through its concept of end-to-end thinking, which will be applied to the projectmanagement processes and to the business processesof a project’s clients. Areas of practice addressedinclude the measurement and improvement of pro-cesses, the application to customer and marketingmanagement, and financial decision making.

• Financial Decision Making for Management(MIT 525): This course is an introduction to the

basic financial principles and tools required for orga-nizational management. Students will develop theability to respond to the concerns and motivationsof the financial community or financial stakeholderswho are important constituencies of any enterprisethat ultimately impact the flow of money to everyorganization. Specific emphasis will be placed onthe topics of understanding costs, the time value ofmoney, economic analysis techniques, and methodsof evaluating business proposals. The intent is toprovide the learner with a “toolbox” of practical,useful personal tools, that will support the decision-making process when business projects are beingassessed. The course integrates well with the areas ofpractice that include performance measurement,process improvement, and the need to be innovativein the application of financial techniques.

• IT Security and Management (MIT 530): Thesecurity of information and information systems isinextricably linked to the operation and assets ofany organization. Protecting the information net-work infrastructure is essential to protecting ourbusinesses and organizations. This course providesthe essentials of information technology (IT) secu-rity from a management perspective. It examines theprocesses of security, including information assur-ance, privacy, backup and recovery, and disaster pre-paredness. This course provides an overview ofinformation security processes for managers. Stu-dents will examine methodologies for implementingsecurity, security policies, best current practices, pri-vacy, backup/recovery, disaster preparedness, andincident response. The outcome of this process is astrategic security plan.

• Reflective Leadership and Planned Change (MIT550): This course addresses the complexity andchanging nature of business environments that chal-lenge organizations and their members to becomeadaptive and innovative. This course is an introduc-tion to a variety of leadership models and to theemerging role of all managers as agents of change.Students will develop the knowledge and skills forharnessing, navigating, and leading change in theirrespective organizations; they will reflect on theirexperiences as leaders and assess who they are as lead-ers based on the models presented and used in thecourse. Areas of emphasis include personal leadershipphilosophy, change as an ongoing and dynamic pro-cess owned by everyone in the organization, and the



emergence of change leaders. Special attention willbe given to change as a process that impacts people,affects organizational relationships, is driven byfinancial/market forces, and needs to be measuredin terms of organizational results. Among the areasof practice addressed are human resources and orga-nizational relationships, financial and operationalresults, the need to understand market-drivenchanges, and the role of values as evidenced by theorganizational culture.

• Legal Aspects of Digital Investigations (DIM 530):This course discusses advanced legal issues related tothe seizure of digital devices. The course will reviewsuch laws as the Computer Fraud and Abuse Act(CFA), Electronic Communication Privacy Act(ECPA), and Privacy Protection Act (PPA), with par-ticular attention paid to evolving decisional law sur-rounding the Fourth Amendment and devicedevices. Liaison to other agencies, laws of othercountries, and international laws will also be exam-ined. Issues related to trial preparation, presentationof digital evidence, use of expert witnesses, and pro-viding testimony will be examined in detail. Specialattention will be paid to jurisdictional differencesrelated to digital investigations and cybercrime,particularly as they relate to rules of evidence; e.g., Fed-eral Rules of Evidence (FRE) compared with the differ-ent state standards based on Frye, Daubert, or othercriteria. Students for this course will be expected tohave basic familiarity with criminal law and procedure.

• Current Topics in Digital Investigation Tech-niques (DIM 540): This course examines advancedcomputer and network forensics issues, techniques,and procedures. Topics will include mobile deviceforensics (cell phones, PDAs, MP3 players, etc.),examination of network devices, current researchtopics in digital forensics, and best practices in digi-tal investigations.

• Laboratory Operation and Accreditation (DIM550): This course discusses practices and issues relatedto the management of a computer forensics lab foreither the public or private sector. Topics will includebest practices in lab operation, case management, evi-dence management and storage, maintaining profi-ciency, personnel training and certification, anddevelopment of policies and procedures. Accreditationfrom organizations such as the American Society ofCrime Laboratory Directors (ASCLD) and compliancewith standards such as ISO 17025 will be discussed,

including the pros and cons, cost, process of compli-ance, impact on employees and processes, etc.

• Digital Investigations for Civil Litigation (DIM560): The course introduces principles of digitalinvestigations that are specific to civil litigation.Though litigation support services typically utilizemany of the same tools, processes, and proceduresas public sector criminal investigations, private sec-tor use of computer forensics frequently involvesissues that the public sector does not often consider,such as data recovery and restoration, erasure ofmedia, and electronic discovery. Students will exam-ine case studies of public sector digital investigationsto compare with private sector methodologies.

• Research Methodology (DIM 570): This courseprovides an overview of the research process fromthe experimental, developmental, and evaluativeperspectives. Techniques for planning and designingthese different types of projects as well as the meth-odologies for data collection, evaluation, and analysisare examined. Students will gain an understanding ofrelated statistical measures. The development ofconclusions based on the data analysis in terms ofpredefined hypotheses and/or project goals andobjectives will also be discussed.

• Legal Issues for Management (DIM 580): Thiscourse will address the legal and ethical issuesrelated to operating public and private sector organi-zations. Topics will include the nature and evolu-tion of organizational ethics in the twenty-firstcentury; labor law to include compensation, medi-cal and employee privacy, hiring, termination, andlegal distinctions between employees and indepen-dent contractors; and disclosure requirements toinclude Sarbanes-Oxley. Grant application sourcesand reporting requirements will also for covered forboth the public and private sectors.

• Integrative Capstone Project (DIM 590): Thiscourse will provide students with the opportunity tointegrate all disciplines and competencies that havebeen learned in this program into a single work-basedproject, internship experience, or other appropriateactivity. The project will be the culmination of a stu-dent’s studies integrated in his or her area of special-ization or expertise. In cooperation with an advisor,the student will design, research, and implement aproject that is comprehensive in nature and thataddresses, to the extent feasible, all core areas ofknowledge around which the program has been built.



The foundation courses, MBA 500 and DIM 500,are taken at the beginning of the program and the cap-stone course (DIM 590) is taken at the end. Theremaining courses can be taken in more or less anyorder in accordance to the prerequisite structure.

PROGRAM PEDAGOGYThe M.S. DIM program was specifically designed to

be offered online to adult learners who are currentlydigital forensics practitioners. It is worth noting thatthere are no formalized prerequisites for admission tothe program. The ideal candidate has at least two yearsof digital forensics practice prior to entering the pro-gram, but applicants with an undergraduate degree incomputer forensics or a strong foundation in criminaljustice or information technology might also makestrong candidates. Indeed, all students starting in theprogram are required to have a practical and/or aca-demic foundation in the computer forensics process.

This section will describe integrated reflective prac-tice (IRP), the pedagogic foundation of the program.Kessler [9] described other online course pedagogiesand issues specific to adult learners, which are onlybriefly reviewed here. This section will also brieflypresent some of the generic issues related to onlinelearning environments (OLEs); although the collegeuses the ANGEL learning management system (LMS),this article will not present a critique of the product.

Integrated Reflective PracticeThe M.S. DIM program, like the MBA and MIIT

programs before it, is built on the pedagogical founda-tion of Champlain’s learning model called integrated

reflective practice [13]. IRP emerges from the disciplineof workplace learning, which is, by definition, learningfrom experience. Through workplace learning, IRP’sroots draw on the learning theories of Dewey, Lewin,and Piaget, including Dewey’s observation that learn-ing is a dialectic process integrating social aspects,experience, and abstractions [14–16].

Integrated learning occurs at two levels; throughselected interdisciplinary activities that link core con-tent courses and assignments that require integratingclassroom theory to the workplace (Figure 1). Theinterdisciplinary nature is created through a whole pic-ture perspective in which six areas of managementpractice are addressed repeatedly throughout the pro-gram’s courses: measurement and process improve-ment, values-based leadership, innovation throughinformation, financial and economic resources,human resources and organizational relationships,and customers, markets, sales, and marketing.

Courses are also integrated with the workplacethrough action learning projects in which students learnfrom real problems and develop an understanding ofthe linkages between theory and practice. Projects com-prise a significant portion of each student’s time spentand their assessment, typically involve stakeholders inthe workplace, and provide one of the primary vehiclesfor reflection before, during and after their develop-ment [17]. Employing course work that integrates thesix areas of management practice, the student’s work-place environment, and personal reflection is the key tothe M.S. DIM course development (Figure 2).

Learning is reflective because personal reflection isrequired in every class as a means of students capturingnew knowledge from their own experiences. Reflection isthe nexus of experiential learning in the workplace and

FIGURE 1 Major components of IRP and areas of management practice [13].



provides a foundation for true lifelong learning. Reflec-tive, or double-loop learning leads to improved perfor-mance and new knowledge about practice [18].

Learning theorists have long held that reflection isnot necessarily a solitary activity and can best includeothers [19]. Reflection, then, includes aspects of col-laborative learning where teams work together to solveproblems [20, 21]. Public reflection such as that used inonline and real-time discussion groups is a corner-stone to all DIM courses [22].

Learning is linked to practice through both coursecontent and the learning process. Project-based learninghas immediate appeal to students because they are deal-ing with a real problem in a very concrete way. If theproject deliverable is modeled after those seen in theworkplace, then the learning has the added benefit ofproviding valuable career education as well. In the case ofthe DIM program, the ongoing stream of projects pro-vides several points at which the student needs to investi-gate a problem in the workplace and deal with theuncertainties of vaguely understood issues, looselydefined problems, and incomplete data. Taken together,the set of projects completed in the DIM program willprovide a portfolio of real work that provides studentswith a sense of self-confidence about their abilities tostart with nothing and finish with a work product thatthey can be proud of. It is the consistency in the use ofintegration and reflection along with a practitioner orien-tation that is unique to the IRP learning model [17, 23].

Online Course PedagogyQuality online courses require quality content,

course design, and material presentation. Proper

educational pedagogies support the production ofthese materials as well as the IRP model. In theabsence of a single unified theory of learning, theDIM program employs a variety of teaching pedago-gies to reach a wide variety of students with differentlearning preferences, attempting to employ the bestcharacteristics of each pedagogic model where theonline environment could leverage the greatest advan-tage [24, 25]. As suggested above, all of the learningtheories used are based on Dewey’s active learningmodel, which enhances student performance,improves their general attitude toward the course andmaterial, and helps to create a sense of communityamong students and faculty [16, 26, 27].

Five pedagogic models provide the main guidelinesfor the design of the master’s degree curriculum. Thefirst is social constructivism, Piaget’s theory that cogni-tive structures are the building blocks of learning andextended by Dewey and Vygotsky, who observed thatlearning is a social activity. Constructivism suggeststhat students create new knowledge based upon whatthey already know; students’ mental organizationskills need to be honed so that they learn new cogni-tive structures and how to build the linkages betweenthem [16, 28, 29].

An OLE is well suited to constructivism if the tech-nology supports the tools of social discourse, such ase-mail, discussion forums, white boards, blogs, wikis,text messaging, and voice conferencing facilities.Because of the lack of social activity that would nor-mally be found in an on-campus classroom, onlineinstructors must be diligent and maintain as muchsocialization is possible; fortunately, the Internet andmodern LMSs provide a wide range of communica-tion tools. Because students can view lectures at theirown pace and as many times as necessary, they alsofeel more free to communicate with the instructor andother students at any time during the week.

The second model is resource-based learning (RBL).The Internet is today’s equivalent of the Library ofAlexandria in terms of the availability of resourcematerial on every subject imaginable—in both refinedand unrefined form. Unlike the Library of Alexandria,of course, the Internet does not contain all knownknowledge as many students believe; there is a lot ofinformation—and history—that predates the Internetand has not yet been digitized, as well as a great dealof wrong information and purposeful disinformation.Nevertheless, there is clearly an unprecedented volume

FIGURE 2 The relationship between IRP and M.S. DIMpedagogy [13].



of current and new knowledge accessible via theWorld Wide Web, and the acceleration of the addi-tion of new information on the Web can be over-whelming. The timeliness of Web-based informationmeans that presentations and discussions can be basedupon what is known at the moment rather what wasknown at the beginning of the course term. Students,too, can look up items of information to augment anylecture and do homework research—and keep instruc-tors on their toes. RBL also provides the instructorwith the opportunity to give students more interestingand relevant assignments, projects, and tests.

The acceleration of change in the digital forensicsfield makes the almost limitless technical referencelibrary of the Internet and online knowledge basesessential for graduate students, reminding the authorsof this story about Albert Einstein (however apocry-phal it might be): During the 1940s, Einstein oncehanded his secretary an exam to be distributed to hisgraduate physics students. The secretary looked at thepaper and said, “Professor Einstein, these are the samequestions that you used last year. Won’t the studentsalready know the answers?” “It’s all right,” repliedEinstein, “You see, the questions are the same as lastyear, but this year’s answers are different.” The Inter-net and online resources can accommodate a widevariety of learning preferences and teaching styles,allow for the presentation of a number of views aboutan issue (requiring that students be instructed abouthow to apply critical thinking to the information theyacquire), encourage students’ curiosity and investiga-tive skills, and engage students in active learning [25].

The third pedagogic model is collaborative learning,as suggested above. Group exercises teach team build-ing and communication skills and demonstrate thesynergy that a group brings to problem solving.Through this, students gain a more thorough under-standing of the subject matter as they promote anddefend their views while hearing other peoples’ ideas.Students also learn about roles and negotiation. TheOLE technology tools that support social constructiv-ism also support collaboration and group exercises[16, 27, 30].

Problem-based, or project-based, learning (PBL) is thefourth model integrated into the DIM curriculumdesign. Real, relevant, and tangible problems generallymotivate students more than contrived assignments.Students will generally make real-world assumptionsthat come from their own environments in order to

solve these problems, adding further relevance as theyhone their problem-solving skills. PBL is well suited toconstructivism because students apply what theyknow to fully define the problem and find one ofwhat may be many solutions to the stated problem; itis also well suited to the online environment becausebigger, more interesting problems can be devised—andsolved—using collaboration and the Internet as aninformation resource [30, 31].

The final pedagogic model is narrative-based teaching(NBT), which means to teach by telling stories or shar-ing experiences. Digital forensics benefits from narra-tion and real-life “war stories” from instructors andstudents alike due to the rapid changes in technology,methodology, regulation, and law, coupled with thefact that every digital investigation is different. NBTprovides a glimpse into the very real practical, techni-cal, and ethical issues that arise every day in the field.Narration fits well in an online course because mediatools such as audio, video, and animation can enableand enhance the story telling. Providing a personal,real-world context helps make a subject more memora-ble, interesting, fun, and engaging [25].

The Online Learning EnvironmentOnline courses provide students with access to edu-

cational opportunities that might otherwise be lockedout due to a variety of reasons ranging from their workor family schedule to their geographic location.Champlain College’s online courses provide an asyn-chronous, virtual classroom complete with an instruc-tor, fellow students, syllabus, course assignments,projects—and rigor. Graduate courses are taught ineight-week terms so that five terms can be presentedeach year (four during the traditional fall and springsemesters plus one in the summer). Students typicallytake one course per term (although they are allowed totake two) and attend courses between three to fiveterms each year.

Because of the key role that communication playsin the curriculum pedagogy, LMS and adjunct tech-nology must provide a variety of communication andcollaboration tools, including a threaded discussioncapability that allows students to post comments forthe entire class (or group) as well as an e-mail facilitythat allows message exchange between a student andthe instructor or between students. Text messaging,voice and video conferencing, wikis, blogs, and shared



whiteboard facilities support real-time (synchronous)class or group meetings. All of these capabilities arepresent in ANGEL, the LMS employed by ChamplainCollege (Figure 3). External services, such as Skype,provide small group audio and videoconferencing.

In some ways, the online virtual classroom hassome distinct advantages over the traditional class-room for graduate courses. First and foremost, theonline environment can allow more students to getinvolved in more class discussions because of its asyn-chronous nature. Some students are not active inclassroom discussions for a variety of reasons, includ-ing not always having a well-reasoned comment toadd. In the online classroom, students have time tothink and create their responses to the comments ofothers and have time to post a response hours or daysafter the original comment was made. In fact, mostonline instructors require some level of participationin discussion so that all students are involved andengaged in the class, something that may not happenas often in an on-campus class. This additional time tosynthesize the material and discussions further rein-forces public reflection and social constructivism.

Finally, other features allow the power of the Inter-net to be integrated into the course. A list of Internet,college library, and other online resources, for exam-ple, can be built in to the course so that students canaccess tutorial and other adjunct materials. Remedialbackground information can be made available within

the online class via links to tutorials and a student-runpeer-tutoring service. Technical difficulties can beaddressed via an online (and telephone accessible)help desk. All in all, there are many features to makethe online classroom a complete learning experience.

Online Courses and the Adult LearnerChamplain College’s online graduate courses are

specifically designed for adult learners, who are gener-ally more mature and self-directed than traditional-aged students. Adult learners are best served withactive, PBL methods, as suggested above. Essentialcourse design elements include clearly stated goals andobjectives, learning modules that are as small as possi-ble, and as high a level of interactivity between theinstructor and other students as possible. Students arealso advised up front about the time expectations forthe course as a whole, as well as per assignment, toeliminate surprises that could deter success [25].

It is important that online courses be as technology-transparent as possible. Online courses should bedeveloped so that content and other features are acces-sible by students employing a wide range of Webbrowsers, operating systems, or types of Internet con-nection, and technology requirements must be madeknown to the students prior to the beginning of thecourse. Course developers balance the computerpower and network bandwidth required for each

FIGURE 3 Sample ANGEL screenshot from DIM 500 (Practice of Digital Investigation).



course so that it best suits the material to be delivered(e.g., Web pages, streaming video, graphical image,audio, etc.) and the likely capabilities of the students,to assure the widest possible audience; an animation,for example, would better be delivered using Flash, acommonly available browser plug-in, rather than aproprietary application that is browser specific. A highlevel of computer sophistication should not be arequirement for online courses and good technicalsupport must be readily available to students to reducefrustration and ensure that they do not feel cast adrift[25, 32–34].

The bottom line is that the OLE needs to empha-size content rather than technology and the technol-ogy should enable rather than inhibit the learningexperience. Indeed, quality of content is king; excel-lent technology cannot save poor content, althoughpoor technology can prevent access to excellent con-tent. The online course Web site itself should be aes-thetically pleasing and ergonomically sound. Inaddition to being attractive, the information on thesite needs to be up-to-date and the pages easy to navi-gate—and even entertaining. The content needs to bewell written and relevant and use vernacular that isfamiliar to the audience; the perception of a site asboring, poorly organized, or confusing can have a dev-astating effect on the students taking the course. Thesite does not need to be technologically fancy, how-ever, because simple Web pages, text, and e-mail canbe quite effective; students actually find it moreimportant to be able to read a lecture and have theflexibility to set their own pace and time of study thanto be able to hear a lecture and have face-to-facecontact with the instructor and fellow students[25, 35, 36].

CONCLUSIONThe concepts offered in this section provide an

overriding guide for the development of onlinecourses in the graduate DIM program. The pedagogicbackground shows that online courses are not merelyonline correspondence courses but designed basedupon well-founded learning theories.

Course development teams are responsible for thecreation and review of all DIM courses. At the heart ofthe content preparation is a subject matter expert(SME). The SME may not have particular expertise ineducation or technology; the instructional technologists

on the team work closely with the SME to find anddevelop appropriate media, assignments, deliverymodes, and other items necessary to facilitate theonline classroom. One advantage of online courses isthat SMEs and instructors can be located literally any-where around the globe.

SummaryUndergraduate education in digital forensics is a

multidisciplinary field, combining aspects of computerand network technology, criminal justice, computerforensics, and cybercrime. Graduate-level education inthis field has two obvious paths, namely, a deeperlook into the technical aspects of digital forensics andmanagement of those engaged in digital investiga-tions. Coupling our experience with undergraduateeducation in this space and our other management-related graduate programs, Champlain College electedto pursue the latter path, developing an M.S. programin Digital Investigation Management.

The key pedagogy for the M.S. program is inte-grated reflective practice, a learning model wherebystudents grasp and apply new knowledge and skills interms of their current professional experiences. IRP issupported by a number of learning theories that allemploy active learning. The essential goal is lifelonglearning, which is particularly important in thisrapidly changing field. As Alvin Toffler observed,“Tomorrow’s illiterate will not be the man who can’tread; he will be the man who has not learned how tolearn” [37].

The M.S. DIM program officially started inSeptember 2009 and is a fully online program (exceptfor a three-day residential experience during MBA500). The LMS offers communication technologiesthat support the social aspects necessary for IRP, activelearning, and social constructivism. Online educationis an important vehicle for a wide variety of academicand practical disciplines; one advantage for graduateprograms in an emerging field such as digital investiga-tions is that expert instructors and practitioner stu-dents can be drawn from all over the world.

ACKNOWLEDGMENTSThe creation of the M.S. DIM program first grew

out of discussions with Michael E. Schirling, currentlychief of the Burlington (VT) Police Department and



former coordinator of the Vermont Internet CrimesTask Force. The authors thank him and the othermembers of the M.S. DIM Advisory Committee fortheir advice during the proposal process. In addition,we appreciate the comments of the anonymousreviewers of this article.

This work was partially supported by Grant No.2006-DD-BX-0282 awarded by the Bureau of JusticeAssistance. The Bureau of Justice Assistance is a com-ponent of the Office of Justice Programs, which alsoincludes the Bureau of Justice Statistics, the NationalInstitute of Justice, the Office of Juvenile Justice andDelinquency Prevention, and the Office for Victimsof Crime. Points of view in this document are those ofthe authors and do not represent the official positionof the U.S. Department of Justice.

REFERENCES1. Institute for Security Technology Studies. Law Enforcement Tools

and Technologies for Investigating Cyber Attacks: Gap AnalysisReport. Hanover, NH: ISTS, 2004. Available from http://www.ists.dartmouth.edu/library/215.pdf [cited 28 July 2009].

2. Stambaugh, H., Beaupre, D., Icove, D. J., Baker, R., Cassaday, W.,and Williams, W. P. State and Local Law Enforcement Needs toCombat Electronic Crime. Washington, DC: National Institute ofJustice, 2000. Research in Brief (NCJ 183451). Available fromhttp://www.ncjrs.gov/pdffiles1/nij/183451.pdf [cited 28 July 2009].

3. Stambaugh, H., Beaupre, D., Icove, D. J., Baker, R., Cassaday, W.,and Williams, W. P. Electronic Crime Needs Assessment for Stateand Local Law Enforcement. Washington, DC: National Institute ofJustice, 2001. Research Report (NCJ 186276). Available fromhttp://www.ncjrs.org/pdffiles1/nij/186276.pdf [cited 28 July 2009].

4. National Institute of Standards and Technology. Education andTraining in Digital Evidence: A Guide for Law Enforcement, Educa-tional Institutions, and Students. Gaithersburg, MD: NIST, TechnicalWorking Group for Education—Digital Evidence, in press.

5. Yasinsac, A., Erbacher, R. F., Marks, D. G., Pollitt, M. M., andSommer, P. M. “Computer Forensics Education.” IEEE Security &Privacy 1 (2003): 15–23.

6. Cohen, F., and Johnson, T. A. “A Ph.D. Curriculum in Digital Foren-sics.” In Proceedings of the 42nd Hawaii International Conferenceon Systems Sciences (HICSS 42), ed. R. Sprauge. Los Alamitos, CA:IEEE Press, 2009.

7. Craiger, P., Ponte, L., Whitcomb, C., Pollitt, M., and Eaglin, R.“Master’s Degree in Digital Forensics.” In Proceedings of the 40thHawaii International Conference on Systems Sciences (HICSS 40),ed. R. Sprauge. Los Alamitos, CA: IEEE Press, 2007.

8. Induruwa, A. “Managing the Pedagogy of Cybercrime ForensicsStudy at the Post Graduate Level: Challenges and Opportunities.”In Proceedings of CFET 2007: The 1st International Conference onComputer Forensics Education & Training, ed. D. Edgar-Nevill.Canterbury, UK: Canterbury Christ Church University, 2007.

9. Kessler, G. C. “Online Education in Computer and Digital Foren-sics: A Case Study.” In Proceedings of the 40th Hawaii Interna-tional Conference on Systems Sciences (HICSS 40), ed. R. Sprauge.Los Alamitos, CA: IEEE Press, 2007. Available from http://www.garykessler.net/library/Online_C&DF_education.pdf [cited 28 July2009].

10. Kessler, G. C., and Schirling, M. E. “The Design of an UndergraduateDegree Program in Computer & Digital Forensics.” Journal of Digital

Forensics, Security, and Law 3 (2006): 37–50. Available from http://www.garykessler.net/library/C&DF_curriculum.pdf [cited 28 July2009].

11. Kessler, G. C., and Haggerty, D. “Pedagogy and Overview of aGraduate Program in Digital Investigation Management.” In Pro-ceedings of the 41st Hawaii International Conference on SystemsSciences (HICSS 41), ed. R. Sprauge. Los Alamitos, CA: IEEE Press,2008. Available from http://www.garykessler.net/library/Grad_Pedagogy.pdf [cited 28 July 2009].

12. Rogers, M. K., and Seigfried, K. “The Future of Computer Foren-sics: A Needs Analysis Survey.” Computers & Security 23 (2004):12–16.

13. Haggerty, D. A., and Stone, V. J. “Champlain MBA: Developmentof an MBA Program based on Integrated Reflective Practice.”Paper presented at the 16th EDiNEB International Conference, Mt.Washington Conference Center, Baltimore, MD, June 2009.

14. Keeton, M., Ed. The 1994 International Experiential LearningConference. Chicago: The Council for Experiential Learning,1994.

15. Lambdin, L., Ed. Roads to the Learning Society. Chicago: Councilfor Adult and Experiential Learning, 1991.

16. Phillips, D. C., and Soltis, J. F. Perspectives in Learning. New York:Teachers College Press, 2004.

17. Douglas, D. “Reflections on Research Supervision: A GroundedTheory Case of Reflective Practice.” Research in Post-CompulsoryEducation 8 (2003): 213–229.

18. Jarvis, P. The Practitioner Researcher: Developing Theory from Prac-tice. San Francisco: Jossey-Bass, 1999.

19. Boud, D., Keough, R., and Walker, D. Reflection, Turning Experi-ence into Learning. New York: Nichols, 1985.

20. Cranton, P. “Types of Group Learning.” In Learning in Groups:Exploring Fundamental Principles, New Uses, and Emerging Oppor-tunities, ed. S. Imel. New York: John Wiley & Sons, 1996.

21. Senge, P. The Fifth Discipline: The Art and Practice of the LearningOrganization. New York: Doubleday, 1990.

22. Raelin, J. Work-Based Learning: The New Frontier of ManagementDevelopment. Upper Saddle River, NJ: Prentice Hall, 2000.

23. Kuit, J. A., Reay, G., and Freeman, R. “Experiences of Reflec-tive Teaching.” Active Learning in Higher Education 2 (2001):128–142.

24. Dahl, B. “A Synthesis of Different Psychological Learning Theo-ries?—Piaget and Vygotsky.” Philosophy of Mathematics Educa-tion Journal (2003). Available from http://www.ex.ac.uk/∼PErnest/pome17/pdf/bdahl.pdf [cited 28 July 2009].

25. Weller, M. Delivering Learning on the Net: The Why, What, & Howof Online Education. London: Kogan Page, 2002.

26. Considine, C., and Dean, T. “Active Learning in Distance Educa-tion.” In Proceedings of the 2003 American Society for EngineeringEducation Annual Conference & Exposition. Washington DC: ASEE,2003. Available from http://soa.asee.org/paper/conference/paper-view.cfm?id=18267 [cited 28 July 2009].

27. Meyers, C., and Jones, T. B. Promoting Active Learning: Strategiesfor the College Classroom. San Francisco: Jossey-Bass, 1993.

28. Alesandrini, K. “Visual Constructivism in Distance Learning.”USDLA Journal 16 (2002). Available from http://www.usdla.org/html/journal/JAN02_Issue/article03.html [cited 28 July 2009].

29. Donaldson, J. A., and Knupfer, N. N. “Education, Learning, andTechnology.” In Designing Instruction for Technology-EnhancedLearning, ed. P. L. Rogers. Hershey, PA: Idea Group Publishing,2002.

30. Naidu, S. “Designing and Evaluating Instruction for E-Learning.” InDesigning Instruction for Technology-Enhanced Learning, ed. P. L.Rogers. Hershey, PA: Idea Group Publishing, 2002.

31. Duch, B. J., Groh, S. E., and Allen, D. E., Eds. The Power of Prob-lem-Based Learning. Sterling, VA: Stylus Publishing, 2001.

32. Bernat, F., and Hall, C. C. I. “Teaching on the Internet: LessonsLearned from a Substantive Criminal Law Class.” Journal ofCriminal Justice Education 11 (2000): 295–312.



33. McKenzie, I. K. “Distance Learning for Criminal Justice Professionals inthe United Kingdom: Development, Quality Assurance and PedagogicalProprieties.” Journal of Criminal Justice Education 13 (2002): 231–249.

34. Swan, K. Relationships between Interactions and Learning inOnline Environments. Orlando: The Sloan Consortium, 2004. Avail-able from http://www.sloan-c.org/publications/books/interac-tions.pdf [cited 28 July 2009].

35. Dutton, J., Dutton, M., and Perry, J. “How Do Online StudentsDiffer From Lecture Students?” Journal of Asynchronous LearningNetworks 6 (2002). Available from http://www.sloan-c.org/publica-tions/jaln/v6n1/pdf/v6n1_dutton.pdf [cited 28 July 2009].

36. Fabianic, D. “Online Instruction and Site Assessment.” Journal ofCriminal Justice Education 13 (2002): 173–186.

37. Toffler, A. Rethinking the Future. New York: Bantam Books, 1971.


udfp1556-72811556-7346journal of digital forensic practice ... · computer forensics labs, hiring...

Documents