Simulation in digital forensic education

The paper starts by describing the role of simulation and role play in education and training. A variety of examples, such as flight simulation, medical simulation, military personnel and stress, simulation in computer science education. The core definition of simulation is that it allows students to explore a problem area in a safe and controlled environment. We contrast different approaches, such as high versus low fidelity simulation. Virtual worlds represent one strand of simulation, and have been used in education to teach a variety of subjects. Simulation is already used in many areas of the forensic subject area, for example by giving students suspect disks to analyse, asking them to seize a computer system in different scenarios, or delivering evidence in a simulated court. Forensic simulation both teaches cognitive practical skills, and acts to reduce the anxiety related to working as a digital forensics practitioner. We are evaluating the use of virtual worlds to extend the range of convenience of forensic simulation and to allow a larger range of scenarios to be used. A comparison of 'role playing' and automated simulation will be undertaken. We anticipate that for a given development cost a larger variety of scenarios can be used with students, and that more autonomous and learning from a distance can be used. During the academic year 2009-2010 we intend to build a series of forensic simulations, using two different virtual world systems, Second Life (Linden Labs) (a widely used Internet virtual world 'built by the denizens of second life') and Wonderland (Sun Microsystems) (a closed local virtual world, which allows a virtual environment to be run locally behind a firewall). Conventional role playing simulations will also be used. The evaluation will compare development effort for each environment. Development cost, deployment cost, student engagement, student skill acquisition, and student enjoyment. Introduction: simulation in teaching Simulation means the recreation of critical aspects of an activity. In the context of training and education it is often used with activities in less costly or dangerous environments. Board games represent a crude simulation of certain aspects of military strategy. During the nineteenth century, with the increased professionalisation of military forces, the use of live action role playing war games allowed military training in standing armies to continue. As many professions involve use of increasing complex systems, simulation has involved embedding the trainee in an artificial environment of some sort. Simple flight simulators have been in use since the first world war (for example in training the skills necessary for aerial combat). The Link simulators were a successful series of electro-mechanical simulators used from 1929 to 1955 [1], but the increase in power of computers meant that computer based simulators, as the basis for games, and for basic training, started to appear around 1979. Microsoft's Flight Simulator was first released for Apple II computers around 1980 [2]. Flight simulation represents a fairly limited and constrained domain, but the development of computing power means that more complex richer virtual environments can be developed. In 1987 the term 'virtual reality' was first used by Jaron Lanier [3], (forms of 'virtual reality' existed much earlier, such as Morton Heilig's Sensorama (an electro mechanical analog simulation) from 1962. Virtual reality has continued to be used for training and education recent examples look at the impact of immersive environments on medical training [4] [5]. Role playing using physical simulation (such as artificial patients) is increasingly used in education in safety critical domains such as medicine, the focus of the University of Portsmouth ExPERT Centre [6]. The emergence of virtual worlds Virtual worlds represent a peculiar mix of features from virtual reality and training simulation. They are usually defined as persistent virtual environments, but experienced through a 'window' rather than being truly immersive. Early virtual worlds used text descriptions to create the world (for example Will Crowther's Adventure developed during 1975-6). A major innovation was the move from a single player exploring the virtual space, to network games (Multi User Dungeons or MUDs). Bartle and Trubshaw are reputed to have developed the first MUD in 1979. Graphical representations replaced the text descriptions, as micro computers became more powerful, and increasing access to computer networks, and their increasing speed, in the latter part of the twentieth century meant that all the pieces were in place for large multiuser graphical virtual worlds. The World of Warcraft (WoW) [7] was originally created in 1994, and as gone through a series of enhancements in its user interface and game complexity. It currently claims over 11 million users, and represents a special form of MUD known as a massively multiplayer online role-playing game (MMORG). Although much of this game involves virtual violence, success in the game is only possible through virtual cooperation and team building. [8]. More recent virtual worlds have stressed social interaction, and have emphasised user contributed creativity (usually of virtual objects), over user contributed mayhem. Such worlds tend to have developed object creation and editing systems embedded, and tools which can facilitate collaboration. Linden Labs (founded in 1999) created Second Life in 2003 [9]. Unlike World of Warcraft, Second Life does not have an explicit goal as such, its users activities usually reflect their interests in 'real' life. Creation of virtual goods and their sale is one of the significant activities in Second Life. Second Life has been used in education quite extensively. It has been set up with a 'teen' grid (13-17 years of age), an area that does not allow adult users, except for faculty members within specific constrained regions. In Higher Education (HE) its been widely used, partly because of its low start up and running costs. A forensics (medical examiner) simulation in Second Life. [10] Simulation using virtual worlds in UK HE In 2009, "Second Life remains, by far, the ‘virtual world of choice’ for academics in UK universities and colleges. Though OpenSim is mentioned by a minority of vocal academics, the number of non-SL uses and investigations across UK academia is still a small fraction of the SL uses" [11]. Virtual worlds such as Second Life can be used in three main areas. As development environments in themselves, for example in development of three dimensional interactive systems or games. It can also be used as a collaboration environment, and allows students to work together online on a single project (even when the students are actually located far apart). Its large number of real users mean that student enterprise projects, involving construction and marketing of goods and services are viable. Finally, it three dimensional environment mean it is suitable for simulations. A large number of UK Universities have some presence in Second Life, in many cases developed 'campuses' often reflecting the 'real' buildings of their campus. Second Life is often used a support framework, for students (often distance learning students). Reviewing the Virtual Worlds Watch snapshot for 2009 reveals some specific examples of the use of Second Life in teaching:  Computer games: Loughborough University, University of Teeside, Bromley College  Project Management: University of Bedfordshire  Health Informatics: University of Plymouth  3D design: University of Sunderland, University of Hertfordshire, University of Strathclyde  General topics in Computer Science: University of Greenwich, HeriotWatt University, The Open University.  Theatre Design: Coventry University  Health, medical and bioscience applications: Glasgow Caledonian University, Nottingham Trent, University of Worcester, University of Sunderland Its use in non-computing education has often been in simulation. Experience in virtual worlds at the University of Portsmouth includes its use in several final year undergraduate units, covering subjects such as HCI, Educational Computing and in final year engineering projects [12]. It has also been used with off campus students in several units, partly as a communication framework, in countries such as China, Malaysia, Iran and South Africa. It appears to help formation of peer support networks among distance students. Its also been used as a collaborative development environment. Our previous experience has mainly been in the development and collaboration areas of teaching [13]. In 2009-2010 we are developing a simulation based environment for teaching specific aspects of digital forensics. Simulation for Digital Forensics Real and virtual world simulations Simulation is already used in many areas of the forensic subject area, for example by giving students suspect disks to analyse, asking them to seize a computer system in different scenarios, or delivering evidence in a simulated court. Forensic simulation both teaches cognitive practical skills, and acts to reduce the anxiety related to working as a digital forensics practitioner. A project under way at the University of Portsmouth, within the School of Computing will be used during teaching in 2009-2010 will compare real and virtual world simulations. One aspect of digital forensics education is seizure simulation. Seizures involve visiting a suspect's premises and seizing data devices and media for examination. Although this sounds straightforward there is a continual risk that data will be lost or compromised (for example access dates modified) so the process of digital evidence seizure is often quite complicated. Students need to be able to understand and implement the Association of Chief Police Officers (ACPO) guidelines for the seizure of digital evidence [14]. Applying these can be difficult in practice. Digital forensics specialists may not be directly involved in seizures in criminal cases, (although may be on hand to advise police officers), however they may be directly involved in commercial seizures (for example confiscating a suspect's work computer at his place of work). Information from the environment may reveal things about the suspect that aid the investigation of files and passwords. Creating scenarios in the real world can be difficult. At the University significant amounts of money were spent on scenario development, with little opportunity for reuse, which created an unsustainable cost for the courses. Ideally they need to be 'dressed' like a stage set, which means the range of possible scenarios is quite limited in the context of an education establishment. A lot of time can be spent setting one up. In Universities space is often 'charged for' which makes finding suitable available rooms quite difficult, and permanent space is often impossible. In the University of Portsmouth a permanent (cross departmental) 'forensics house' was set up, this provides quite a vivid simulation of seizure of data devices from the scene of a violent crime, in order to justify the costs of this resource it is used on many different kinds of forensic course in the University. Even using a real location (such as an academic's office) has flaws. As a result exposure to seizure simulation is quite limited. In this project a range of seizure scenarios is being developed. Students will be asked to perform a seizure task, collecting information from the environment, and compiling this into a report. Disk images of the data devices collected will be provided. Complexity of the related images can be used to differentiate between different levels of study. Seizure scenarios will be implemented in three different ways. A conventional real world simulation, a simulation in Second Life, and a simulation in Project Wonderland. Virtual worlds allow us to store a complex scenario, and bring it out as required. (Even on demand by students). In Second Life a tool called a holosuite can act as a convenient repository for a scenario. Large rooms (such as an open plan cubicled office) can be stored using this sort of tool. An advantage of the inworld / face to face context is that work can continue in world, whilst classroom conversations between tutor and students, and between students can provide a useful additional communication channel. Both in world and in face to face scenarios, role playing will be used, with students and tutors taking on roles. In some cases simple 'bots' (avatars animated by scripts) can be used. In world, image capture can be used as a form of photography. Students may replay the same scenario taking on different roles.