Do digital investigators have to program? A controlled experiment in digital investigation

We report on the results of an exploratory study in which graduate students played the role of digital investigators within an advanced digital forensics course. Overall, 39 students were split up into 10 groups. Each group had to solve one out of three arguably realistic cases within a time frame of 11 weeks. Participants had to log their actions and the corresponding time effort. The resulting data was analyzed in order to identify differences in investigative strategies as well as factors that influence the quality of the results. As can be expected, the total effort (in minutes) generally positively influences the results, but rather surprisingly, participants did not (have to) program to solve the cases although they were restricted to using publicly available tools.