Using digital forensics in higher education to detect academic misconduct

Abstract Academic misconduct in all its various forms is a challenge for degree-granting institutions. Whilst text-based plagiarism can be detected using tools such as Turnitin™, Plagscan™ and Urkund™ (amongst others), contract cheating and collusion can be more difficult to detect, and even harder to prove, often falling to no more than a ‘balance of probabilities’ rather than fact. To further complicate the matter, some students will make deliberate attempts to obfuscate cheating behaviours by submitting work in Portable Document Format, in image form, or by inserting hidden glyphs or using alternative character sets which text matching software does not always accurately detect (Rogerson, Int J Educ Integr 13, 2017; Heather, Assess Eval High Educ 35:647-660, 2010). Educators do not tend to think of academic misconduct in terms of criminality per se, but the tools and techniques used by digital forensics experts in law enforcement can teach us much about how to investigate allegations of academic misconduct. The National Institute of Standards and Technology’s Glossary describes digital forensics as ‘the application of computer science and investigative procedures involving the examination of digital evidence - following proper search authority, chain of custody, validation with mathematics, use of validated tools, repeatability, reporting, and possibly expert testimony.’ (NIST, Digital Forensics, 2021). These techniques are used in criminal investigations as a means to identify the perpetrator of, or accomplices to, a crime and their associated actions. They are sometimes used in cases relating to intellectual property to establish the legitimate ownership of a variety of objects, both written and graphical, as well as in fraud and forgery (Jeong and Lee, Digit Investig 23:3-10, 2017; Fu et. al, Digit Investig 8:44–55, 2011 ). Whilst there have been some research articles and case studies that demonstrate the use of digital forensics techniques to detect academic misconduct as proof of concept, there is no evidence of their actual deployment in an academic setting. This paper will examine some of the tools and techniques that are used in law enforcement and the digital forensics field with a view to determining whether they could be repurposed for use in an academic setting. These include methods widely used to determine if a file has been tampered with that could be repurposed to identify if an image is plagiarised; file extraction techniques for examining meta data, used in criminal cases to determine authorship of documents, and tools such as FTK™ and Autopsy™ which are used to forensically examine single files as well as entire hard drives. The paper will also present a prototype of a bespoke software tool that attempts to repurpose some of these techniques into an automated process for detecting plagiarism and / or contract cheating in Word documents. Finally, this article will discuss whether these tools have a place in an academic setting and whether their use in determining if a student’s work is truly their own is ethical.