Meet Dr Graeme Horsman, Senior Lecturer at the Cranfield Forensics Institute and course director of the Digital Forensics MSc.
Dr Horsman’s research covers digital crime scene triage, methods for communicating digital evidence findings, and procedures for maintaining quality standards in digital forensics investigations.
Can you tell us a little about your role within Cranfield Forensics Institute, and what your research covers?
“I joined Cranfield in March this year from Teesside University. Prior to my academic career, I worked in a private-sector digital forensics firm. I’m quite a research-active member of staff, having published probably 50 or so papers over the last few years, and all my research is focused on helping the industry. It’s not blue-sky thinking, or theoretical; the intention is always to try to provide something that can support industry practice and be used straight away. For instance, I’ve published several papers on digital trace interpretation and digital crime scene triage, looking at procedures for protecting trace evidence. I’m also interested in how we as digital forensics professionals communicate our evidence findings and maintain quality standards.”
What is digital forensics, and why does it matter?
“Digital forensics is a sub-branch of forensic science. The role of a digital forensic scientist is to gather and interpret digital traces in order to support law enforcement inquiries and the judicial system. In practice, this can be massively diverse – of course, there are mobile phones, computers, and laptops, but also game consoles, routers, wrist watches, vehicles, and even smart lightbulbs! Anything that has a digital aspect and could provide evidence relevant to an investigation is our domain. The job of a digital forensic scientist is to gather the trace evidence in an appropriate manner, analyse it, interpret it, assess meaning and provide that information to the relevant authority to help them make sense of what happened. A lot of the time we work in a post-mortem environment, so it can feel a bit like putting together the pieces of a jigsaw puzzle. Our job is to collect those puzzle pieces and try to form a complete picture of what went on. When people think of digital forensics they might think of cybercrime, of some sort, but the reality is the nature of how digital has permeated every aspect of our everyday lives means you could be handling evidence in a drugs investigation, road traffic collision, or even a murder enquiry.”
Can you give me some examples of where digital forensics has played a major role in bringing a perpetrator to justice?
“Technology is everywhere, and people don’t necessarily realise the traces they leave behind. There have been several examples of crimes where the digital trace evidence has either put someone at a scene at a particular time or showed a build-up of intent. For example, I remember the case of a pharmacist near Middlesbrough who was arrested and is now serving a prison sentence for killing his wife. He left a trail of digital evidence that eventually led to his conviction. The Apple Watch he wore on his wrist showed him running up and down the stairs in the house and all the physical exertion of the crime. There was also CCTV evidence, and the search history on his laptop and apps on his phone showed he was planning to leave his wife and go to Australia. The Anglesey crossbow murder also springs to mind, where someone shot and killed a retired lecturer with a crossbow outside his house. Telematics in the perpetrator’s vehicle placed them at the location at the time and date the incident occurred. And then, of course, there’s the Salisbury poisoning, where CCTV evidence shows the journey the poisoners took through the village.”
What is it about this field that interests you most?
“Working in digital forensics is challenging, but the challenges and problems you encounter are different every day, and solving them means helping and supporting a worthwhile cause in the sense of law enforcement. It’s a very diverse area and not a career where you just sit back and enjoy the ride. You have to keep pace with the technology as it changes, constantly improving your skills and pushing yourself to learn new things. In digital forensics, you can never learn enough. You’ll probably never get beyond just scratching the surface of all the things there are to know. You specialise because it is just so huge that no one can tackle all of it. That’s why we need to train more people up so that everyone can have their areas of expertise and we can all thread ourselves together to provide a really good digital forensics service.”
What drew you to research as a career path?
“To be honest, it’s something I just kind of fell into. When I was working as a practitioner, I was offered a scholarship to do a PhD, and then an opportunity came up after that to stay in academia for a bit longer, and now here I am still years later. Academia wasn’t something I ever thought I would end up in, but I did and it’s great.”
Why did you choose to work at Cranfield?
“When I was studying, and throughout my early career, Cranfield was always the place to go if you wanted to do a digital forensics master’s. All my colleagues would talk about it as providing the gold standard in qualifications, and I would see police officers and other law enforcers consistently sent to Cranfield to gain the knowledge and skills they needed. I never got the chance to study at Cranfield, but I’m excited to be part of it from the other side of the lecture theatre.”
What do you like best about your job?
“Digital forensics has been my life for nearly 20 years, but joining Cranfield with its intense research focus has given me more freedom to go out and look for some of those challenges that those in industry don’t have the time or resources to solve, and to try to find solutions. There’s an opportunity there to be the first to solve a problem, to provide tangible benefits to industry, and to make a real impact in the world. That’s what I like best, and what keeps me motivated.”
Tell me more about the new Digital Forensics MSc
“The course is suitable for people wanting to enter the field of digital forensics as well as those already working in it that want to progress their skills. They might have a degree in IT and want to specialise or be looking to progress their career in law enforcement through additional training and upskilling. It is designed to be a really strong technical challenge that provides students with good core and advanced skills in digital forensics and digital investigation. We cover a wide range of topics, from the fundamentals around digital evidence and scenes of crime to advanced techniques in mobile forensic analysis and programming for digital forensics. The aim is to equip students with all the skills they will need to engage effectively and successfully in the digital investigation process, and do that well, robustly, accurately, effectively, and be good practitioners.”
How do the facilities at Cranfield compare to others you’ve seen?
“We’ve got an amazing set-up in CFI. We’ve got a 24-seater lab with top-of-the-range PCs with industry-standard software that enables students to engage in all of the forensics processes that we need and are used out there in the real world, as well as another spacious laboratory where we can do different exercises. We have breakout rooms and a state-of-the-art chip-off lab which enables us to do teardowns of hardware, which is something you wouldn’t get at many places. The students will be able to get hands-on with the hardware, software and devices found in industry, and deep dive into the forensic techniques in use today.”
Finally, how does working in this field impact your own digital behaviour? Are you more hesitant to use technology as a result?
“I’m definitely very aware of my own digital footprint. You can’t do this job and not be. Aside from anything else, it’s actually surprisingly easy when developing activities for students to contaminate the evidence you’re trying to plant with your own personal data. I do try to be a bit tidier online, especially on social media, but some of that has happened naturally as I’ve got older. If I was 15 and in this environment, I think it might be a different story!”
