Digital forensic investigations at universities in South Africa

The purpose of this study is to explore the need for digital forensic investigations at universities in South Africa and to determine if a university is forensically ready to conduct effective digital forensic investigations. For this research paper, the University of Cape Town is used as a case study. The research explores the existing digital forensic investigation process at the university and determines its capability to conduct a comprehensive digital forensic investigation. Both qualitative and quantitative research methods were applied to this study using questionnaires, interviews and secondary data (documentation). Existing research within the field of digital forensics tends to focus on for-profit organisations, while educational institutions, such as the case study in this paper, have been largely ignored. Educational institutions have a strong emphasis on teaching, learning, research and support, thus the drive to increase digital forensic capability is less than at forprofit organisations. However, it is becoming increasingly important for all organisations to develop digital forensic capability due to the ever increasing rate of cybercrime. The key findings in this research established that the University of Cape Town had no demand for digital forensic investigations on campus and therefore had no formal digital forensic investigation process in place. The university had a minimal capacity to conduct these investigations and had no policy to manage digital forensic investigations. It was also found that digital forensic readiness should be developed at the university to ensure the capability to conduct digital forensic investigations. Further, some of the existing processes at the university could be adapted to develop a digital forensic readiness capability.