Saturday, 5 May 2012

Digital Forensics: Integrating Researcher and Practitioneer

If you are thinking to do a research in Digital Forensics (master degree or PhD), Nance et al. [1] article is a good start for your critical reading. There are a few categories to pick up and further divided into motivating areas that might be of your interest.

Well, I wish you good luck. It is going to be difficult because you need to justify why you choose that particular topic. Basically, you will need to defend your choice. You need to have an 'insight' in the chosen area and above all must be passionate about it.

Avoid choosing something that is relatively new i.e. cloud forensics or the one that requires a lot of fund i.e. mobile phone forensics (e.g. dismantling the packaging and study on the hardware to extract digital evidence). You don’t want to change your topic after a year of research or worse during your second year.

If everything is fine than at the end of 3 years you will finish writing your thesis and get your PhD. But one big question will arise! Is your discovery @ new knowledge will contribute to the digital forensics practitioner community?

Perhaps, during your critical reading, you might find some papers that are not exactly contributing to the practitioner need. Purely theoretical (academic) but not practical (practitioner). Not sure, refer below links.


Is this an issue? Yes and no. What is the suggestion for betterment?

It is advisable for the researcher and practitioner mindset to be ‘coherent’. Both need to work together in order to fight against cybercrime (direct or indirectly). A practitioner does not have time to do research and a researcher is not entrusted to investigate a case. Both need each other and to date the relationship is progressing satisfactorily.

But sometimes, things are beyond our control. Think about it!

[1] K.Nance, B.Hay and M.Bishop. “Digital Forensics: Defining a Research Agenda” in Proceedings of the 42nd Hawaii International Conference on System Sciences, 2009.