# Encouraging Equivocal Forensic Analysis Through the Use of Red Herrings

Wai Sze Leung

► To cite this version:

Wai Sze Leung. Encouraging Equivocal Forensic Analysis Through the Use of Red Herrings. 13th IFIP World Conference on Information Security Education (WISE), Sep 2020, Maribor, Slovenia. pp.184-197, 10.1007/978-3-030-59291-2_13. hal-03380702

HAL Id: hal-03380702

https://inria.hal.science/hal-03380702

Submitted on 15 Oct 2021

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Encouraging Equivocal Forensic Analysis through the Use of Red Herrings*

Wai Sze Leung[0000-0002-9015-6329]

University of Johannesburg, Johannesburg, South Africa

wsleung@uj.ac.za

**Abstract.** A core concept taught to forensic investigators is the practice of equivocal forensic analysis which is strongly advocated by researchers and practitioners to limit investigators from reaching incorrect conclusions, either due to their own bias, or as a result of subjectivity from others. The process is however a time-consuming one and students may not see the value in doing so amidst a busy academic schedule. This paper examines how the use of the red herring plot mechanism in a game-based storytelling environment can be used in a computer forensics semester module to effectively highlight the importance of evaluating the available evidence objectively and thus encourage students to avoid falling into the trap of developing and following preconceived theories.

**Keywords:** Confirmation bias · Digital Forensics · Equivocal Forensic Analysis · Game-based storytelling.

## 1 Introduction

Objectivity and a healthy dose of skepticism are essential skills that all professional forensic investigators must demonstrate [1]. Unfortunately, the goal of concluding an investigation in a scientific manner that is free from bias, can be extremely difficult to achieve, with preconceived theories representing one of the greatest root causes of errors in such complex problem-solving scenarios [2,3]. Considering that such findings are effectively expert opinions that legal proceedings may accept when reaching a decision in a court of law, expressing an incorrect view of what might have occurred in an incident can lead to serious consequences ranging from the loss of life to irreparable damage to one's reputation [4,5]. As such, lecturers tasked with teaching students in forensic investigation-related subjects should ensure that awareness of bias is raised so that students conscientiously avoid such a pitfall.

Teaching students this lesson is not simple—a lecturer can educate students on the concept of ‘equivocal forensic analysis’, telling the students how the process entails conducting objective and independent evaluations of the available evidence to establish the true (most likely) meaning behind that evidence [5].

<footnote>* This research benefitted, in part, from support from the Faculty of Science at the University of Johannesburg.</footnote>
Further, a lecturer may insist on the importance of equivocal forensic analysis. However, failure on the part of the lecturer in integrating this theory with practice can lead to students who struggle to apply the lessons in the real world [6].

Such an observation by education researchers highlights the need for a digital forensics classroom that affords its students with opportunities to integrate theory with practice [6]. In this paper, we describe how we designed and implemented an ongoing exercise where students were able to develop their reasoning and analytical skills while applying appropriate digital forensic techniques in uncovering the next act in a story-driven game.

The rest of this paper is structured as follows: Section 2 provides background on how mistakes in forensic investigations can be attributed to a lack of objectivity for both the investigator and colleagues. Next, Section 3 examines how storytelling is used as an epistemological approach in guiding this knowledge discovery process. As the stories are meant to push students along, they need to contain a degree of momentum that encourages its audience to remain engaged as the story unfolds. Section 4 will thus look at how stories can be propelled forward using various plot mechanisms. Based on the various elements introduced in the previous sections, Section 5 will detail the resultant game that was developed to increase objective investigative practices amongst digital forensics students. Finally, Section 6 will conclude the paper with points identified for improving future offerings of this particular learning exercise.

## 2 Challenges to Objectivity in Investigations

Under the correct conditions, a forensic investigation involves following a rational, systematic approach to identifying relevant evidence, preserving this evidence, analyzing the evidence, and interpreting its results in order to construct a balanced and plausible account of events for presentation to others [7,8].

Although evidence itself cannot be wrong, different persons examining it may view it differently, opening up the possibility of multiple interpretations of what the evidence represents [9]. The truthful outcome of the investigation thus hinges on the ability of the forensic examiner to discern the correct interpretation of said evidence [1,9].

Unfortunately, this task of selecting the correct interpretation does not appear to be an easy one with a report produced by the President's Council of Advisors on Science and Technology in 2016 suggesting a considerable degree of flawed conclusions that have led to the potential miscarriage of justice [10]. Such inaccuracies paint a very grim view for the justice system when courts rely on the expert testimonies of forensic examiners to make its critical decisions [4,11,12]. This apparent weakness in forensic examinations has led researchers from multiple disciplinary areas to identify factors contributing to these unacceptable errors, some of which include: (i) Competency; (ii) External influences; and (iii) Bias.
## 2.1 Insufficient knowledge and technical competence

Perhaps the most obvious issue relates to the forensic examiner being capable of acting competently during an investigation [3]. An expectation exists that everyone involved in an investigation is familiar with the techniques, standards, and protocols, following them correctly and appropriately.

While further discussion on this factor lies beyond the scope of the research, it is important to note the researchers have attributed the technical competence shortcoming to gaps in training, citing the need for additional education initiatives to address the concern [12]. Further to this, it was also noted that teaching forensic investigators must extend to ensuring that forensic investigators also know how to sustain adherence to guidelines once they are practicing in the field [13]. Such arguments support our initiative to incorporate greater awareness of potential fallacies of forensic investigations in our digital forensics classroom.

## 2.2 External influences

Linked closely to the aforementioned factor of sufficient technical competency is the issue of having multiple individuals involved in any given investigation - with one party handling the evidence acquisition and another its examination, there needs to be the assurance that all parties involved carried out their tasks correctly since each individual's findings are contributing some part to piecing together a greater puzzle [14].

Investigators may also produce erroneous results due to external influences insisting that an investigation be hurried along, or for the investigator to either focus or neglect a particular aspect of an investigation so that outcomes favourable to the external parties are ensured [15]. As experts in a court of law, [15] has indicated investigators must resist such influences and ensure that they behave ethically and legally.

Unfortunately, while one may successfully reject apparent attempts to influence an investigation's outcome, the human element in each of us can still lead to our third identified source of error, namely bias.

## 2.3 Bias

The topic of bias as the source of considerable error in forensic investigations has been covered rather extensively by researchers [16,17,18,19].

Bias can manifest in two categories, most of which apply to all forensic investigations in general: (i) motivational bias where the investigator may unintentionally be inclined to look for incriminating evidence rather than exculpatory ones (evidence that will demonstrate the lack of criminal intent on the part of an accused person) in a bid to build up a case against an identified suspect [20]; and (ii) cognitive bias where the person behaves in a biased manner without realizing that they are being biased [14,18]. Each of the three cognitive biases is summarised as follows:
- **Contextual bias** – although forensic scientists may require context to carry out their job properly [14], [17] notes that many forensic experts are exposed to irrelevant contextual information which can also have a detrimental effect, influencing how the forensic expert conducts their work.

- **Confirmation bias** – a decision-maker may tend to seek out or interpret evidence in such a way that it favors their existing beliefs or hypotheses while ignoring or devaluing any evidence that would contradict them [20,21]. Reaching incorrect conclusions because of confirmation bias is thus not necessarily the result of a lack of capability, but rather, due to poor reasoning and an “overall human tendency for laziness” [3].

- **Expectation bias** – similarly to confirmation bias, this form of bias is the result of reaching conclusions prematurely without having examined all the facts or having conducted the examination thoroughly [20]. Experienced investigators, who have many years of working on similar cases, are seen to be particularly susceptible to expectation bias as they see it as “yet another one of those cases” [5].

## 2.4 Equivocal Forensic Analysis

The previous section on bias highlights a particularly problematic issue for forensic investigators who are tasked to carry out their duties scientifically, approaching each discovery or evidence with objectivity and skepticism [1]. To tackle this problem, [5] propose the process of equivocal forensic analysis as a means of combating bias effectively.

When working with evidence that could be interpreted in more than one way, it would be responsible to treat it as open-ended without settling on a particular conclusion based on the assertions of others without further review. With the possibility that several people with varying degrees of expertise may have contributed to the various conclusions, it is not inconceivable, given the discussion on how errors in analyzing evidence can be introduced, that some of these findings may be flawed. With equivocal forensic analysis, a forensic examiner will examine said evidence items again, objectively and independently of findings from others. This allows them to familiarize themselves with the entire case, ascertain that the investigations were conducted correctly, verify that a crime has indeed taken place, and possibly identify new evidence or clues that may have been previously overlooked [5].

Choosing to conduct equivocal forensic analysis can be time-consuming as carrying out the process typically equates to a repetition of the investigative process itself. However, this not only ensures that fundamental issues relating to the investigation are addressed, but that every assertion made is correct [5]. Furthermore, going through the investigative process will not only allow the investigator to become familiar with the overall case, but it also protects their careers as they are effectively staking their professional reputation on the veracity of their findings [15].

These reasons should present students with a compelling reason to undertake equivocal forensic analysis to minimize bias while examining the evidence as
objectively as possible. However, this may continue to be a challenge due to how
classrooms have traditionally been set up.

## 2.5 Cognitive Bias in the Classroom

It can be argued that universities do not adequately prepare students to deal with bias during the course of their education. In particular, students are not presented with the appropriate learning opportunities to develop their ability to mitigate bias.

Firstly, students tasked with writing an argumentative essay will tend to misrepresent the strength of any counter-arguments they may find, undervaluing their importance so that their original assertion would appear to be the more plausible state of affairs. This apparent cognitive bias, however, cannot be wholly blamed on the student. If the success of an argumentative essay is linked to the strength of their argument, why would a student sabotage their work by acknowledging any counter-arguments as credible points? When one is induced to advocate for a particular stance, any efforts to find and organize evidence will naturally be made in favour of advancing that particular argument. Simply, the reasons for avoiding confirmation bias would be contrary to the student achieving their goal [22].

Secondly, the topic of cognitive biases does not seem to be a common topic in academic materials on research methods. [23] argues that this is shortsighted of academia considering the significant influence that cognitive biases can have on a research study's outcomes. Given how many experts have failed to recognize their own biases in a field that relies much on objectivity such as forensic science [19], it would not be surprising for novice researchers to find themselves failing to realize the subjectively-flawed choices in their research design.

The approach to getting students to tackle their cognitive biases will therefore require a different approach–[23] points out that simple didactic teaching or awareness-raising will not suffice, given that cognitive biases have already taken hold in most young adults. Rather, students should be exposed to repeated learning opportunities that encourage them to approach problems that do away with closed solutions, focusing on open-minded decision-making strategies instead.

## 3 Teaching through Stories

One manner of promoting engaged student learning is through the approach of storytelling [24]. Considered a powerful pedagogical tool, storytelling has gained a reputation for successfully delivering messages that are both educational and entertaining [25]. The use of storytelling as a mechanism for teaching has yielded positive results such as higher student involvement (including emotional) and increased critical thinking in subjects where more traditional pedagogical choices have led to students perceiving the subject matter to be “dull” [24,25].

Infused with an element of adventure, stories arm lecturers with the ability to contextualize knowledge, making it more accessible to students who can relate
to the content and achieve greater learning gains as a result [25,26]. Through
context, the stories encourage students in developing several skills that include
exercising their cognitive skills, establishing the meaning behind events, and
retaining key points better [26].

Besides, the suitability of using storytelling in the classroom is further sup-
ported by its ability to allow lecturers to weave different technical topics to-
gether [24]. By demonstrating to students how each topic fits in the overall
scheme of forensic investigations, students have the additional benefit of gaining
a greater appreciation for the aforementioned topics.

Storytelling is thus a very attractive pedagogical approach for teaching com-
puter forensics–the opportunity exists for lecturers to shape learning experiences
that foster cognitive skills while exposing students to cognitive bias and present-
ing them with the opportunity to manage this bias. With the right elements,
storytelling can deliver an overarching experience that allows students to test
their competence of various computer forensics tasks (such as identifying evi-
dence at a search and seizure scene, creating a forensically sound image of a
suspect’s disk drive, and recovering files that the suspect may have attempted
to delete) throughout the course of the story.

Storytelling in the classroom, however, does come with a warning—the choice
to tell stories requires considerable planning as they are complex and indirect,
requiring preparation that allows the lecturer to rapidly adapt the story in re-
sponse to however students respond. This is necessary to ensure that both the
story and the underlying educational message is retained in its delivery [27].

4 Introducing the Red Herring

Since one of the purposes of using storytelling as a pedagogical approach to
teaching and testing students on the flaws of cognitive biases, there will need to
be elements of the story that present the student with scenarios that include the
opportunity for students to work with evidence items that are purposely riddled
with ambiguity. As indicated earlier, errors in investigations typically arise due
to the evidence being in a state that is open to multiple interpretations. Other
than ensuring that any ambiguity remains logical, their inclusion throughout
the story needs to be done with moderation to ensure that students are not
overwhelmed or discouraged by poor storytelling that does not move the plot
along.

This can be achieved utilizing plot mechanisms such as red herrings in the
story. Red herrings refer to a common plot device often used in mysteries and
are clues that are either false or misleading. When written well, red herrings
are meant to reveal useful information along the way [28]. The purpose of red
herrings in our context is to create distractions that incite student interest, pur-
posely baiting them into making decisions about the interpretation of a partic-
ular evidence item. To encourage individual work in this regard, the ambiguous
possibilities will have varying levels of a likelihood that may or may not corre-
spond strongly with the student’s existing knowledge of the story thus far.
The intention is to encourage students to not allow their cognitive biases to
take shortcuts without considering the alternatives that exist.

5 A Gamification Approach

Traditionally, our Computer Forensics module has been a primarily theoretical
one with the theory conveyed in a series of lectures. While there has been a
move to incorporate an increasing amount of the practical exercises into various
exercises over the years, coverage on the topic of bias and equivocal forensic
analysis remained topics that were briefly discussed in passing. Assessment on
either topic typically involved asking students to describe the process of equivocal
forensic analysis, referring to how doing so would address potential inaccuracies
introduced by bias. Such an approach is considered rather elementary according
to Bloom's Taxonomy and thus lacks the depth As desired of digital forensics
professionals, resulting in individuals poorly-prepared for applying the theory in
the real world.

To improve this shortcoming and deliver the topics in a more practical man-
ner, a story-driven adventure was set up to span the majority of the semester
(lasting 13 to 14 weeks). While this storytelling approach has been implemented
to some degree in four different offerings, the inclusion of red herrings to edu-
cated students on managing their biases has only been presented twice, in 2018
and 2019 to class sizes of 18 and 21 students respectively. In our offerings, stu-
dents assumed the role of a recent recruit who has been accepted into the local
police department's cybercrimes division. Throughout the story, students engage
in several computer forensics-related tasks, most of which contributed to a part
of the primary plot and mystery of that year.

To introduce the potential for bias from out students, each primary plot
borrowed heavily from major news events that had occurred that year—the mo-
tivation for doing so was to see if students allowed events that were happening
in the real world to influence how they viewed the in-game characters that were
caricatures of their real-life inspirations. In some cases, these similarities were
deliberately intentional to see if students would make the mistake of allowing
their bias to influence their decision-making.

For use to assess the students’ decisions that were made to reach their various
conclusions, students were taught how to prepare written detailed reports that
describe the tools used and methods followed. Great emphasis is placed on how
their reports must be sufficiently rigorous to stand up to scrutiny. Each student
is then required to submit a report in which they detail their particular path
of investigation so that their findings can be verified through the reproduction
of their processes. These detailed reports allowed for us as the assessor to fol-
low the thought processes of each individual to establish how they reached the
conclusions that they did.
## 5.1 2018: The Accounting Fraud Scandal

In 2018, students were introduced through a series of news bulletins reporting on an international corporation recently accused of questionable accounting practices. The resultant fallout is that millions of hardworking people, a portion of which are about to retire, have had their retirement savings wiped out. The setup of this particular story borrowed heavily from the Steinhoff International Holdings accounting scandal that had been reported on extensively at the beginning of the year.

The investigation into the story is launched with students asked to identify and gather evidence from a crime scene where a businessman has been found dead at the bottom of his staircase in his home. The students are tasked with answering the following: was it an accident, or had someone pushed the businessman? If so, what was the motive for doing so?

In the weeks leading up to this crime scene exercise, news bulletins are made available to students to establish the background of the investigation, with each bulletin introducing a new character who would serve as a potential suspect in the investigation. The four suspects introduced were:

- **The CEO**-head of the Stonehill Investments Network (SIN) Corporation, he comes across as a businessman who continues to enjoy the finer things in life while less fortunate individuals now struggle to make ends meet in the wake of his alleged dishonesty. The victim was a business partner of the CEO and had been threatening to expose him. To some degree, the victim had been established as a vigilante type who was looking to seek justice on behalf of those whose lives had been negatively affected in the scandal.

- **The CEO's Son**-the rich, spoilt only child of the CEO, he stands to lose the privileges he is so used to if his father is indeed guilty of accounting fraud.

- **The IT Staffer**-the skilled head of IT development at SIN, he had helped the victim in creating malware to steal damning information from the SIN servers. He however does not want to engage in illegal activities any longer. The victim had resorted to threatening to report him to the police unless he continued.

- **The Security Guard**-a security guard who is about to retire. He can afford for SIN to drop further in value. However, SIN's values will be wiped out completely if the CEO is exposed.

**Trapping for bias** - during the crime scene search and seizure exercise, students were split into smaller groups and allowed to work with the same crime scene. While the number and nature of the evidence items to be discovered were essentially the same, minor differences were made for each group. For example, a different laptop prop was used or the placement of the evidence was in a different location. Ultimately, each group had to identify and locate a laptop, two USB storage devices, a note, and a mobile phone. Both laptop and mobile phone could either be on, off, or locked with a passcode.
In addition to this, each student was assigned specific variables ‘found’ on the evidence items that would be discovered. For example, while everyone would have found the USB as evidence, the contents on the USB device would be made available to the students electronically. The delivery of the image ‘made’ of the USB drive would then contain content that would implicate or exonerate a particular suspect. In this way, one student’s evidence could very well be another student’s red herring. The outcomes were divided up in such a way that five outcomes were possible: the murderer was one of the four suspects, or, it was merely an accident as the victim had slipped and fallen to his death.

**Students' responses** – perhaps similarly to the work done by [19] where different scenario debriefings presented to students (either murder or suicide) led to vastly different types and amount of evidence found, the 2018 mystery game showed that none of the students concluded that it was likely an accident. Most students believed that the murderer was none other than the CEO, despite the lack of evidence to back this up. Even evidence of the incident being an accident was ignored, despite all four suspects having alibis in place. The tendency for students to opt for foul play would appear closely linked to their expectations for a story with an 'exciting ending'. This is a common expectation that is repeatedly mentioned in feedback provided from students over the years, with students forgoing the more plausible options in favour of endings that go out with a bang.

Specifically, one report documented how each of the suspects had their alibi at the time, demonstrating that they had correctly interpreted the relevant evidence. However, rather than write that there are no clues to suggest that the victim had been pushed off the stairs.

Overall, the results were therefore of poor quality when it came to applying logic appropriately. It further confirmed that students at the Institution were not only biased but did not appear to be aware that they were being biased either. This suggested a lack of understanding of the concept of bias in the first place.

## 5.2 2019: A Case of City Capture

In the following year, the central plot of the story moved to another news topic that was gaining much media coverage, that of ‘state capture’. First coined in 2000, this term was used by World Bank researchers to describe how pretrial parties exert influence over government to extract favourable outcomes for particular private actors at the expense of society [29].

Due to the shortened lecturing period in 2019, there was a need to establish certain settings earlier. This was done by providing students with some background into the history of the city in which the student worked in their module introduction guide (all modules are accompanied by a guide which provides them with the details of the module). In addition to providing guidelines on how to request important documentation such as search warrants and vehicle registration
queries from the relevant personnel at the police department, the guide intro-
duced the wealthy family boasting numerous highly profitable dealings with the
city.

In the first few weeks, students are introduced to several characters, including
a few interactions with the chief of police. In the fourth week, after a fair portion
of the theory has been covered, students are called to apply what they have learnt
(and also, studied up on their own) on one of two different crime scenes with a
particular objective:

- **Murder in the Evidence Room**—the grumpy evidence officer has been found murdered in the evidence room, bludgeoned in the head. As a member of the digital forensics team, students must gather all relevant (digital) evidence in hopes of finding the murderer.

- **Signs of City Capture**-with news that grumpy evidence officer has been found killed in the evidence room, students in the teams sent to investigate the chief of police's office are tasked with finding evidence that the chief might be working to advance the wealthy family's businesses.

Students were split into four groups, two of which investigated the murder while the other two looked into the police chief's dealings. As with the 2018 offering, each crime scene had a similar set of evidence items that were to be identified, bagged, and tagged for further processing. At least one evidence item hinted towards a connection with the other scene. Ultimately, students had to establish whether the chief of police was allowing a wealthy family to influence and control the city police.

Ultimately, the question that must be answered was: ‘Is the chief of police captured by a wealthy family which seemingly have their influence everywhere?’. In the case of those investigating the murder, did the police chief have the evidence officer killed?

**Trapping for bias** – to make the concept of cognitive bias more apparent, the police chief was made to look like the sort of person one would likely dislike. Depending on the group, physical notes found would suggest that the chief is not only corrupt but a racist and having an affair with the police department’s finance officer. Additional evidence found at both crime scenes would further suggest that the evidence officer had been blackmailing the chief and that there is a ‘Mr. Australia’ who is mentioned in several correspondences.

As in 2018, each student was required to analyze the content on the evidence
items that they identified. By delivering a custom set of digital content that is
on the evidence items (the USB drives and laptop – while mobile phones were
discovered in the crime scenes themselves, the analysis on the content of the
mobile phone is beyond the scope of the learning outcomes of the module), each
student is presented with evidence that works towards either establishing the
chief as an innocent or guilty member of the police station. Therefore, for some,
the evidence will implicate the chief while others will indicate his innocence.

Based on the evidence delivered, the outcome of the investigation would have
been:
- **Captured**–the police chief is indeed corrupt, using the finance officer to assist with signing improper deals that benefited the wealthy family. In exchange, the police chief received a lucrative amount of money in exchange. Because the evidence officer had uncovered this corruption, the chief had either personally killed the officer, or the wealth family sent a hit-man to get rid of the evidence officer.

- **All Above Board**–the police chief has been a beneficiary of the wealthy family's generous bursaries funding program. While he is extremely grateful to the family for allowing him to study further, he maintains a strictly professional relationship.

- **The Mystery of Mr Australia**–Mr Australia is either a hit-man (who murdered the evidence officer) from Down Under or, a guest of the police department who wants to learn more about how police officers work in the city. He is a former bodybuilder who is now doing motivational speeches across the country.

**An exercise on cognitive bias** – In light of the poor performance of students in 2018, students were given a research assignment in the first week of the semester in which they were asked to search predatory conferences. The exercise included the students getting briefed on the topic of heuristic searches and confirmation bias. While some reports still yielded bias in their results, approximately 60% of the class delivered reports that suggested attempts to avoid confirmation bias altogether.

Feedback was given back to the students promptly (within a week) to ensure that they were equipped with this knowledge before their search and seizure exercise.

**Students' responses** – unfortunately, it would appear that for most students, the lessons learnt from the early cognitive bias exercise were quickly forgotten with numerous students jumping to conclusions at every possible opportunity. In one example, a student discovering a love message with a name on a Post-It note loudly remarked to their team members that the chief had a mistress. Although this was the intention behind planting the evidence in the first place, it is telling that the student had mentioned mistress as at no point in time, had the team been informed of the chief being married (the intention was for this piece of information to be introduced at a later stage). For the exercise, the note for this particular group was supposed to be ambiguous–through the digital delivery of the content on the evidence the students receive later, students would then discover that the message was either from the chief's wife or his mistress, the police's finance officer.

Despite the setback, the results of 2019 could still be regarded as being an improvement on the bias mitigation front. At least two reports were more careful in their wording, demonstrating caution when it came to making claims. This could be seen in their four teams' group reports in which they documented their findings based on the search and seizure of evidence items alone.
## 5.3 Planned Revisions

With the feedback and consultations with colleagues taken into consideration, the following changes are planned in our next or future offerings:

- Incorporate more regular mentions of bias and the need to manage it throughout the course of the story. This is in line with the findings by [23] who recommended that repeated learning opportunities be exploited to turn it into a habit

- Model suspects on real-life polarizing personalities. Depending on the role, create characters that are based either on an existing individual that the public largely dislikes or adores. This allows us to test students to see if they are either directed towards or away from the suspect as a result.

- Have the teams that conducted crime scene investigations at different sites discuss their findings with each other. It may be helpful to have peers assess each other in terms of whether a particular evidence item should have been interpreted the way it was by the discovery team. Such a setup will lead to part of the student's findings being sourced by another investigator, making the need for equivocal forensic analysis more obvious.

- Break up the detailed report into iterative submissions. One of our findings is that students did not always provide sufficiently detailed reports, leading to some difficulty in assessing their process of reaching their findings. Although our 2018 offering allowed us the opportunity to interrogate students in the form of a question and answer session at the end of the presentation of their findings, the exercise can be time-consuming and impractical with greater class sizes. As an alternative, students will be asked to submit detailed reports after a particular staging of events, allowing for earlier feedback, and allowing the students to revise and work on their final reports in iteratively.

- Consider the introduction of a courtroom setting as the concluding part of the game. During this phase, students will be able to play the roles of different expert witnesses who have been called to testify, either for the prosecution or the defending party. The aim of introducing this addition is to allow students to experience the full incident resolution from discovery to the presentation. By allowing students to represent either side of the court case, it is anticipated that the students will be able to interact with each other, identifying potential counterarguments in response to claims made by the opposition.

It should be however noted that the final item planned may take some time to introduce as initial discussions with members of the legal community have raised concerns over how time-consuming running a moot court hearing can become.

## 6 Conclusion

The problem of cognitive bias in forensic investigations has proven to be a significant one that has garnered considerable attention from researchers in various
disciplines over the years. Since the domain of digital forensics is no different, at-
tention too, must be paid to ensuring that students in this specialization receive
training on how best to minimize their bias.

Through a storytelling approach that deliberately uses red herrings to dis-
tract students, we were able to provide a learning environment that promoted
an increase in awareness of cognitive biases amongst our computer forensics
students to some small degree, leading to reports that expressed less wild specu-
lation and more conclusions that were better founded. However, we noticed that
additional reminders would be beneficial to the students, along with a shorter
feedback cycle in place.

Specifically, we will need to restructure the game and storytelling so that
students can receive feedback sooner and more regularly so that any biased
decision-making can be rectified. This will allow students to submit final reports
that are built on mostly correct findings, as opposed to only finding out in the
end how far from the true state of affairs they have been. It is anticipated that
early feedback will serve as a more regular reminder of bias at play and that
students will recognise the importance of conducting equivocal forensic analysis
in mitigating the effects of that bias, allowing them to reach what should be a
more correct conclusion at the end of the day.

References

1. Turvey, B.E.: Criminal Profiling: An Introduction to Behavioral Evidence Analysis. 4th edn. Academic Press, Oxford, U.K. (2012)

2. Piper, C.E.: Investigator and Fraud Fighter Guidebook : Operation War Stories. John Wiley & Sons, NJ, USA (2014)

3. Turvey, B.E., Crowder, S.: Forensic Investigations: An Introduction. Academic Press, London, UK (2017)

4. Camilleri, A., Abarno, D., Bird, C., Coxon, A., Mitchell, N., Redman, K., Sly, N., Wills, S., Silenieks, E., Simpson, E., Lindsay, H.: A risk-based approach to cognitive bias in forensic science. Science & Justice **59**(5), 533–543 (2019)

5. Casey, E., Turvey, B.E.: Investigative Reconstruction with Digital Evidence. In: Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet, 3rd edn., pp. 255–284. Academic Press, MA, USA (2011)

6. Wrenn, J., Wrenn, B.: Enhancing Learning by Integrating: Theory and Practice. International Journal of Teaching and Learning in Higher Education **21**(2), 258–265 (2009)

7. Gardner, B.O., Kelley, S., Murrie, D.C., Dror, I.E.: What do forensic analysts con-
sider relevant to their decision making?. *Science & Justice* **59**, 516–523 (2019)

8. Hopkins, S., Wilson, A., Silva, A., Forsythe, C.: Facilitation of Forensic Analysis Using a Narrative Template. Procedia Manufacturing **3**, 5022–5027 (2015)

9. Cooley, C.M., Turvey, B.E.: Observer Effects and Examiner Bias: Psychological Influences on the Forensic Examiner. In: Crime Reconstruction, 2nd edn., pp. 61–90. Academic Press, MA, USA (2011)

10. Lander, E., Press, W., Gates Jr., S.J., Graham, S.L., McQuade, J.M., Schrag, D.: Report to the President: Forensic Science in Criminal Courts: Ensuring Scientific Validity of Feature-Comparison Methods. (2016)
11. Almazrouei, M.A., Dror, I.E., Morgan, R.M.: The forensic disclosure model: What should be disclosed to, and by, forensic experts? *International Journal of Law, Crime and Justice* **59** (2019)

12. Biedermann, A., Hicks, T., Voisard, R., Taroni, F., Champod, C., Aitken, C.G.G., Evett, I.W.: E-learning initiatives in forensic interpretation: Report on experiences from current projects and outlook. *Forensic Science International* **230**, 2–7 (2013)

13. Powell, M.B.: Designing Effective Training Programs for Investigative Interviewers of Children. *Current Issues in Criminal Justice* **20**(2), 189–208 (2008)

14. Thompson, W.C.: Developing Effective Methods for Addressing Contextual Bias in Forensic Science. *Office of Justice Programs’ National Criminal Justice Reference Service*. (2018)

15. Casey, E.: Digital Evidence in the Courtroom. In: Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet, 3rd edn., pp. 49–84. Academic Press, MA, USA (2011)

16. Cooper, G.S., Meterko, V.: Cognitive bias research in forensic science: A systematic review. *Forensic Science International* **297**(April), 35–46 (2019)

17. Dror, I.E.: Biases in forensic experts. *Science* **360**(6386), 243 (2018)

18. Kukucka, J., Kassin, S.M., Zapf, P.A., Dror, I.E.: Cognitive Bias and Blindness: A Global Survey of Forensic Science Examiners. *Journal of Applied Research in Memory and Cognition* **6**(4), 452–459 (2017)

19. van den Eeden, C.A.J., de Poot, C.J., van Koppen, P.J.: The Forensic Confirmation Bias: A Comparison Between Experts and Novices. *Journal of Forensic Sciences* **64**(1), 120–126 (2018)

20. Forensics, www.forensicbasics.org. Last accessed 15 March 2019

21. Nickerson, R.S.: Confirmation Bias: A Ubiquitous Phenomenon in Many Guises. *Review of General Psychology* **2**(2), 175–220 (1998)

22. Helping Students Overcome Confirmation Bias, https://nobaproject.com/blog/2018-12-05-helping-students-overcome-confirmation-bias. Last accessed 15 March 2019

23. Stapleton, P.: Avoiding cognitive biases: promoting good decision making in research methods courses. *Teaching in Higher Education: Critical Perspectives* **24**(4), 578–586 (2018)

24. Suwardy, T., Pan, G., Seow, P.: Using Digital Storytelling to Engage Student Learning. *Accounting Education* **22**(2), 109–124 (2019)

25. Herreid, C.F.: Start with a Story : The Case Study Method of Teaching College Science. *National Science Teachers Association*, VA, USA (2006)

26. Storytelling as a Pedagogical Tool, http://teachingthroughthearts.blogspot.com/2012/07/storytelling-as-pedagogical-tool.html. Last accessed 15 March 2019

27. Storytelling: an Important Pedagogical Approach, https://www.westpoint.edu/sites/default/files/inline-images/centers_research/center_for_teching_excellence/PDFs/mtp_project_papers/DzwonczykJ_18.pdf. Last accessed 15 March 2019

28. What Is a Red Herring in Writing? Definition of Red Herring with Examples - 2020, https://www.masterclass.com/articles/what-is-a-red-herring-in-writing-definition-of-red-herring-with-examples. Last accessed 15 March 2019

29. Rothstein, B., Varraich, A.: Making Sense of Corruption. *Cambridge University Press*, Cambridge, UK (2017)