Automating And Sharing Digital Forensics Knowledge Through Hansken
Nowadays, virtually all criminal investigations involve digital evidence. Investigation services in the Netherlands frequently use the Hansken search engine to quickly gain an insight into digital evidence, and foreign investigation services are increasingly working with Hansken as well. That is why University of Applied Sciences Leiden (HS Leiden) and the Netherlands Forensic Institute (NFI) have agreed that Computer Science students will learn to use the search engine.
As of next academic year, Hansken will be a permanent component of the modules followed by Digital Forensics students. The forensic search engine will be installed in the University's IoT Forensic Lab, which is based on The Hague Security Delta campus, next month. ‘It's a win-win situation,’ explains Hans Henseler, professor of Digital Forensics & E-Discovery at HS Leiden. Henseler also works for the NFI. ‘There’s a strong chance that students will go on to work for one of the investigation services or for the NFI. Learning to understand how Hansken works during the course of their studies will give them a significant advantage. Erwin van Eijk, head of the NFI’s Digital and Biometrical Traces (DBS) division, adds, ‘And in turn, the NFI will benefit from students’ knowledge. Digital developments are happening so fast that the NFI can’t keep Hansken up to date on its own. Hansken must constantly adapt to new developments. That’s where students’ help will be very useful.’
More and more digital evidence
‘Nowadays, everything has a computer in it – security systems, cars, computers, for example, and mobile phones, of course. This information often helps to establish the truth in a criminal investigation,’ says Van Eijk. When large amounts of data are seized from suspects, Hansken can quickly offer insight. The most obvious example is the search machine being used to search through data seized from Encrochat, a chat service which was used by many criminals because they believed that the police would not be able to intercept their messages.
Students to build tools for Hansken
HS Leiden is the second educational institution to link up with Hansken, following the Norwegian University of Science and Technology (NTNU). From August 2021, some 150 Digital Forensics students will learn to work with the search engine. ‘Hansken is a welcome addition to the standard tools that are available in our research lab. Given the open nature of the search engine, students can learn to build new tools for the machine themselves,’ explains Henseler. New functionalities appear in computers and mobile phones on a daily basis, and the search engine must constantly be adapted to respond to them. There is now a global Hansken community of international experts who are constantly developing new modules to plug into Hansken.
Collaboration is crucial
Collaborating with universities fits with the vision for forensic research and the vision of the NFI, says Annemieke de Vries, chief scientific and technology officer at the NFI, ‘The NFI is a leader in forensic research and wants to maintain this position. Things are developing ever more quickly. To be ready for the forensic demands of tomorrow, the NFI must constantly invest and innovate. Collaboration with universities is essential in that it enables us to explore the forensic potential of new technical developments in advance.’ Patrick Pijnenburg, director of the Faculty of Science & Technology, agrees, ‘It’s also important to University of Applied Sciences Leiden that our degree programmes are in line with forensic practice. This collaboration with the NFI makes that possible.’
Part-time degree programme too
In September, at the request of the police, as well as the regular Bachelor's degree programme, the university of applied sciences will also launch a part-time version of the Digital Forensics degree programme, and it has recently submitted an application to set up a Master's in Digital Forensics. ‘Both the part-time Bachelor's and the Master's programme are in line with the growing trend for people to combine learning and work and for professionals to acquire knowledge on an ongoing basis in a flexible way,’ says Pijnenburg.