Computer Forensics: Training and Education

This paper is an outgrowth of Erbacher’s panel presentation at the 2002 Computer Forensic Workshop held in Moscow, ID. The concept behind this paper is to provide a discussion of the needs within the computer forensics curriculum focussing specifically in the need for lab-based experimentation as well as arguing the needs for both an educational component as well as a training component. The discussion looks at the differences between training and education and how these two needs can both conflict and enhance one another. The paper looks at the need to integrate the instruction within the curriculum with effective experiments. Finally, we examine some of the legal and policy issues with running such a course. We take as our basis much of the work that has been done within the security curriculum with regards to curriculum development and examine how this prior knowledge can be used to improve the curriculum development process for computer forensics as many of the issues are similar.