Applying forensic principles to computer-based assessment

A computer forensic investigator investigates computer crime. Currently only a few academic institutions have a computer forensic department and, therefore, the investigative responsibility (in case of contravention of assessment regulations for computer-based assessments) rests upon the lecturers. The purpose of our project is to apply computer forensic principles to a computer-based assessment environment to facilitate the identification and prosecution of any party that contravenes assessment regulations. This paper is the first step in that project; its purpose is to consider the nature of such an environment. This nature is derived from the established computer forensic principles. In particular, we focus on the forensic process to determine the policies, procedures and types of tools that should be present in such an environment. The intention of the paper is not to consider any of the issues raised in detail, but to consider the process from a high level. The utilization of different tools, namely a key logger, CCTV camera, audit log and a report of logins, facilitates the identification of any party that contravenes assessment regulations. The proposed process consists of four phases: preparation of the environment, collection of evidence, analysis of evidence, and reporting findings.