Logo: University of Southern California

Nothing but the truth

Students go to court as digital forensics experts
By: Daniel Druhora
May 09, 2016 —


Sean Straw, a junior in computer engineering, questioned by special agent Jack Furay. Photo/D. Druhora

Every year, with the assistance of the Los Angeles District Attorney’s Office and the Los Angeles Superior Courts, Joseph Greenfield’s Advanced Digital Forensics students participate in a moot court exercise in which they are called to testify as digital forensics experts “under pains and penalties of perjury.”

Thirteen aspiring cybercrime investigators rotated in the heat box in front of an audience of 40 industry professionals representing the Secret Service, F.B.I., L.A. District Attorney’s Office, Ernst & Young, PricewaterhouseCoopers (PwC), Maryman & Associates, Deloitte, Stroz Friedberg, Mandiant, Crowdstrike and IBM.

“No pressure, right?” smiled Sean Straw, a USC Viterbi junior in computer engineering as he waited to be summoned into the courtroom, his nervous hands digging into his pockets.

The trial simulated a real-world scenario down to the smallest detail. Students were not allowed to hear each other’s testimony and had to stay in the hallway waiting for the door to swing open and their names to be called.

“Every time that door opens, I just think, ‘stay calm, breathe, and don’t let them lead you,'” said Straw. “’You’re the expert. You lead the testimony’.”

The Honorable Judge Elden Fox presided in the LAX Courthouse and thanked the students for giving him “quite an education” in digital forensics.

Special agent Jack Furay of the U.S. Secret Service questioned the students from the defense side, and L.A. Deputy District Attorney, Benyomin Forer, from the prosecution. The students, for their part, had to pull quickly from a fountain of digital forensics knowledge accumulated in two courses over the span of a year.

“It’s part of their grade, so there’s no escaping the trial,” said Greenfield who has been teaching digital forensics for ten years as part of USC Viterbi’s Information Technology Program. He has opened the class to majors outside engineering but requires students to take an introductory course, ITP 375, prior to full submersion into the labyrinthine world of cybercrime.

“I designed the class as an advanced course focusing on Windows systems. It’s estimated that Windows comprises over 80 percent of the operating systems used worldwide, so we want them to get an in-depth experience of what they’ll likely confront in the real world.”

Advanced Digital Forensics students study their reports before being called into court to testify as expert witnesses. Photo/D. Druhora

Alumni of the class were also on hand acting as both supporters and talent scouts.

“This class is near and dear to my heart,” said Joel Garrison, B.A. ’13, political science and digital forensics, who now works as a senior security consultant at Ernst & Young. “It launched me professionally. So I’m here to support my fellow Trojans and check out the talent. I was in their shoes once and someone did the same for me." 

With cybercrime on the rise, Garrison says there is increased demand for this kind of expertise. In 2015, IBM conducted an independent investigation that revealed 1.5 million cyber attacks hit the Internet every year. That number means there are over 4,000 cyber attacks every day, or 170 attacks every hour.

Microsoft has already created its own Digital Crimes Unit in light of a recent breach barrage that has hit the health-care, financial, higher-education and federal markets, and even the security industry itself. Research firm, Markets and Markets, estimates that by 2017 the global cyber-security market will skyrocket to $120.1 billion.

It is no surprise that more USC students are responding to this challenge.

“I designed my own curriculum,” said Kshitij Kumar, a sophomore studying international relations, digital forensics and enterprise information systems. “I love this course. We get to practice the theory with so many cases thrown at us. The second day of class we got our first case. It’s been the most fun I’ve had in the last three years of studying at USC.” Kumar, who previously interned for the U.S. Department of State, is also working on a senior research project that looks at the major cyber attacks of the last decade and analyzes them for their “political intensity”.

Professor Joseph Greenfield and L.A. Deputy District Attorney Benyomin Forer during the mock trial. Photo/D. Druhora

Computer science junior Rochelle Willard wants to apply the lessons she's learned in the course to software engineering. “I don’t know that I want to be a forensics expert, I love programming too much,” said Willard, who will be interning at Facebook in Cambridge, Massachusetts over the summer. “But in terms of understanding the security infrastructure that goes into software, this is by far the most interesting class I’ve taken. I wanted to go to class every day.”

In case you’re considering becoming a digital forensics investigator, we asked Benyomin Forer, a veteran criminal prosecutor who has cross-examined hundreds of CSI-types, just what makes a sought-after expert witness:

“A great expert witness is someone who is a master of his or her subject matter, able to communicate with integrity to a lay person the concepts he or she is testifying to. The ability to communicate is so critical, because without it, the expertise is lost and unshared. But, it must be done with integrity. So above all else, please don’t lie, even about one little thing. If you don’t know, say you don’t know. Even if the lawyer on the other side drives you mad. Otherwise, even if you communicate effectively, the matter is lost. Just tell the plain simple truth.”

Learn more

Information Technology Program

Digital Forensics (SPECIALIZATION)

Applied Computer Security (MINOR)

Computer and Digital Forensics (MINOR)