How I Created 63 Digital Forensics Cases: Experiences in the Concurrent Generation of Multiple Digital Forensic Scenarios

Academic tutors aim to provide students with realistic teaching and assessment experiences in digital forensic investigation, where digital forensic images (DFIs) are crucial. DFIs are essential for understanding operating systems, file structures, and application behaviours, serving both educational and research purposes. While DFIs can teach various skills, this chapter focuses on those specifically used for training in incident investigation, whether corporate or criminal, referred to as investigative DFIs. Creating investigative DFIs is complex, requiring researchers to ensure contents are realistic and free from real data that could breach data protection laws or pose legal risks. Despite the availability of many DFIs, there is a scarcity of publicly accessible investigative DFIs suitable for assessment tasks. Available DFIs often have their solutions widely disseminated online, reducing their educational value. This situation compels academics to develop their own DFIs, a demanding task requiring the creation of credible, realistic scenarios that align with investigative learning objectives. The development process is time-consuming and requires meticulous attention to detail to maintain a plausible narrative. This chapter explores the challenges of developing effective investigative DFIs, sharing insights from the authors’ experiences and proposing a six-step framework for developing multiple investigative DFIs concurrently. A case study illustrates the application of this framework.