October 27, 2021

What are the Barriers to Teaching Digital Forensics?

By Jess Farrell, Katherine Skinner, and Hannah Wang

To state the obvious, today’s creation and dissemination of knowledge is overwhelmingly digital. Most library, museum, and archives acquisitions now include (and some are even dominated by) digital content in a wide variety of containers and formats. Information managers are charged with managing and stewarding these cultural, historical, and scientific records for current and future users. To preserve complex media, they must know how to intake and explore born-digital materials appropriately. 

Digital forensics is a field with an active community of practice which offers archivists widely used tools and methodologies to survey born-digital content, identify and weed materials with personally identifiable information, accession digital storage media contents while preserving original order, and/or prepare the digital objects for future access via emulation.

In interviews and surveys over the last two years, the BitCuratorEdu project has turned up a significant and deeply troubling void in library and archival education. Across LIS and iSchool programs, workshops, and continuing education offerings, lessons about digital forensics tools and strategies and workflows are rare at best; much more often, they are wholly missing. 

Our research has also surfaced some of the specific barriers to teaching digital forensics–we will be presenting on this topic at Digital Preservation 2021, and we are also knee-deep in writing an article about our findings that we hope to get out in 2022. 

In the meantime, this blog post is intended to informally share a few of our preliminary findings and recommendations to programs and instructors of all stripes.

Digital forensics training tends to be squeezed (and perhaps a bit squishy).

When LIS or iSchool programs offer digital forensics instruction, it is often squeezed into a one or two week period within a broader course on digital curation, digital stewardship, or some similarly high-level introductory concept. Many continuing education courses offer a similar broad survey or purely theoretical approach. While very basic and fundamental theory can be taught in this way, deeper exploration (e.g., of the ethical implications of different acquisition approaches) and hands-on experience (e.g., downloading and using specific tools or exploring workflow elements) are almost impossible to include.

Students and practitioners who miss out on these components also miss the complexity involved in digital acquisition workflows. They are not adequately equipped to assess, much less perform, such work in the context of a short sprint within a broad course, and may experience imposter syndrome or other barriers when they become practitioners. 

Models and guides could help to convey what digital forensics, born-digital acquisition, and born-digital accessioning competencies are, and which ones can be addressed on various timelines and with different approaches. Preparing students to perform digital forensics tasks in their future workplace is not possible in a compact overview, so the difference between a compact overview and practitioner preparation should be better-defined. 

Aptitudes and comfort levels of instructors are highly variable.

Digital acquisition tools and methods continue to rapidly change to meet the ever-increasing volume and complexity of digital materials. As a result, even practitioners who are immersed in day-to-day processing work can find it challenging to stay up-to-date with the latest tools and best practices.

In our research, we are finding that instructors for digital curation and digital archiving often are not directly engaged in born-digital acquisition practices, including those that critically deploy digital forensics tools and workflows. This is most pronounced in LIS and iSchool environments, where many of the professors are not practitioners (nor have they been in the past). Without this experience, it is challenging at best to make digital archiving theory and practice relevant to what is happening today in the world around us. Instructors that rarely, if ever, engage in the work of processing digital materials can feel intimidated by the prospect of teaching a hands-on lesson or demonstrating a tool (and this is also intimidating for people who use these tools every day!). 

Our research also finds that instructors are already at their maximum working capacity, especially in the past year with many courses needing careful re-imagining for virtual delivery. One way to address this gap is to tap into the active community of digital preservation practitioners, including those in the BitCurator Consortium, as guest speakers and internship hosts. We have also found that the instructors who do teach hands-on lessons are more likely to approach their position as a facilitator rather than a professor who has all the answers. Using a hands-on approach for teaching digital forensics means that you have to be prepared for things to go wrong, willing to make mistakes in public, and generous with both yourself and your students as you work through problems together. 

The technical support apparatus is uneven and challenging to navigate.

Today’s graduate classrooms and continuing education environments vary widely in their technical support options, but most are provided with minimal resources. Even in-person LIS and iSchool programs often lack computer labs on site, and only a few well-resourced institutions currently offer virtual computer labs. While a few software companies and hosted solutions in the digital curation arena provide “sandbox” environments that students and practitioners can use to preview or test their software, these are expensive to produce and upkeep and available for a very small number of tools; currently, no digital forensics tools are a part of these environments. An instructor seeking to teach students to use a digital forensics environment often has to ask their students to install a Virtual Machine (VM) on their own computers—leading to an unpredictable array of troubleshooting nightmares for the instructors and students alike. To make this even more challenging, even instructors/professors who specialize in digital topics often have had little-to-no direct exposure to command-line based software installations or the (often tedious) troubleshooting that is ubiquitous with digital tools.

The “lift” is just too heavy, and the dynamics too uncertain, and so students graduate without adequate knowledge and understanding of this work.

LIS, iSchools, and continuing education providers all currently share a common dilemma. The digital tools and environments that students need to learn to use often are not readily available to test, practice with, or use. Using the power of a collective investment, educational organizations could design and build (or help a technical host to build) an educator’s sandbox that would enable students to log in, much as they do to access journals or course materials, and gain access to a working environment that maintains common digital tools and platforms that they need. This would give educational organizations an affordable way to produce a dependable “virtual lab” that develops along with the technology and enables students to gain experience they need in order to begin working in this field.

Learn more

Each of these recommendations requires educational institutions and instructors to engage in a more collaborative approach, something that libraries and archives regularly achieve through established communities of practice and consortial investments. We are exploring the feasibility of partnership opportunities between professors/instructors and the BitCurator Consortium to help support the growth of digital forensics and born-digital acquisition skills. 

Join us on November 4 for discussions about these ideas at the Digital Preservation 2021 conference.