Content area
Full Text
Using smartphones to explore metadata in a simulated criminal case
The term forensic science may evoke thoughts of bloodspatter analysis, DNA testing, and identifying molds, spores, and larvae. A growing part of this field, however, is that of digital forensics (Bertino 2012), involving techniques with clear connections to math and physics (Figure 1).
This article describes a five-part project involving smartphones and the investigation of a hypothetical crime and subsequent mock trial. It was conducted in a forensic science course. Smartphones have become ubiquitous in high schools (Purcell et al. 2013). For our lesson, 31 of 32 students had access to their own smartphones, and, for any who didn't, we made classroom tablet computers available to all. Smartphones can be powerful tools to engage students in a variety of scientific explorations (Kamarainen et al. 2013; Cartwright 2016).
The project
The "big ideas" embedded in the project were password security, cellular metadata, digital forensic examination of a smartphone, interpretation and presentation of evidence, and maintaining evidence through a chain of custody. Resources used, besides the smartphones, included public websites, postermaking materials, a web-based smartphone emulator, an inexpensive "burner" (prepaid) phone, evidence bags, and existing student WordPress blogs.
Part 1: Password strength (60-90 minutes)
The lesson started with a simple exercise about the relative strength of computer passwords. Students entered passwords into a free website (see "On the web") that instantly estimated how long a computer would take to crack their passwords, ranging from milliseconds to years, either via dictionary or brute force attack. (In a dictionary attack, words from the dictionary are tried as possible passwords. If successful, these attacks only take seconds. In a brute force attack, every combination of characters [e.g., a, A, b, B, and so on] and symbols [e.g., !, @, #] are tried one at a time until the password is found. This can take days, months, or years, depending on the length of the password.
Instructors could formatively assess how well students met the challenge of seeing who could create the best password, monitoring their progress from an "over the shoulder" perspective. After about 10 minutes, students shared and compared passwords to help compile as a group samples of strong and weak passwords (Figure 2). (Safety note: Students should...