◇ OpenCyber Academy
Bachelor's · Chapter 4 · English

Chapter 4 — Academic writing

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Academic writing

Lesson map

Lesson 04 published. Map, example, EX010.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Structure"]
  N2["4.2 Citing"]
  N3["4.3 Primary sources"]
  N4["4.4 Plagiarism"]
  N5["4.5 Hedging"]
  N6["4.6 Drafting and revision"]
  N7["4.7 Feedback"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX010"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Structure"]
  N2["4.2 Citing"]
  N3["4.3 Primary sources"]
  N4["4.4 Plagiarism"]
  N5["4.5 Hedging"]
  N6["4.6 Drafting and revision"]
  N7["4.7 Feedback"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX010"]

[Learning outcomes]
    |
    v
[4.1 Structure]
    |
    v
[4.2 Citing]
    |
    v
[4.3 Primary sources]
    |
    v
[4.4 Plagiarism]
    |
    v
[4.5 Hedging]
    |
    v
[4.6 Drafting and revision]
    |
    v
[4.7 Feedback]
    |
    v
[Worked example] --> [Exercise EX010]

Learning outcomes

You will (1) write structured academic prose; (2) cite sources correctly; (3) avoid plagiarism; (4) adapt academic habits to forensic reporting.

4.1 Structure

Introduction (question and why it matters), body (evidence and reasoning), conclusion (answer and limits). Each paragraph opens with its point and supports it.

Leah's essay on volatility order follows this pattern: the introduction asks why collection order matters, each body paragraph treats one class of data from registers to disk, and the conclusion states the recommended order with its limits. Opening each paragraph with its point lets a reader skim the argument before checking the evidence. Dr Ferreira reads only the first sentences of each paragraph to test whether the argument stands on its own.

4.2 Citing

Every factual claim from another source is cited. Leah uses author–year style: "Carrier (2005) divides file-system data into five categories." The reference list gives full details, including DOIs or ISBNs where they exist.

Author–year style lets a reader see who made a claim and when, which matters in a field where guidance changes. A claim from a 2002 RFC about collection order may be read differently from a 2024 standard. The reference list is checked against the text so that every citation appears in both places.

4.3 Primary sources

For standards and guidance, cite the document itself — NIST SP 800-86, RFC 3227 — not a blog that summarises it. Check the version: SP 800-61 has had several revisions, and the current one is Revision 3.

Leah's first draft cited a blog for the volatility order; the worked example shows how she replaced it with RFC 3227. A blog may paraphrase incorrectly or add advice the standard does not give, such as "always". Checking the revision number also matters in reports: a reader who looks up an older SP 800-61 may find different steps and question the analysis.

4.4 Plagiarism

Copying text without quotation marks and citation is plagiarism even if the source is cited elsewhere. Paraphrase genuinely, or quote and cite.

The same rule applies to tool output and colleagues' notes: if Leah copies a paragraph of analysis from a classmate's lab report, it must be marked and attributed. Genuine paraphrase means restating the idea in her own structure, not swapping a few words in the original sentences. When in doubt, quoting exactly with a citation is always safe and lets the reader see the original wording.

4.5 Hedging

Academic writing uses calibrated language: "suggests", "is consistent with". Forensic reports do the same, but more strictly — every hedge must reflect the actual evidence.

A forensic hedge must match the evidence: "the process tree is consistent with the spreadsheet launching rundll32" is appropriate when the tree shows the link but other explanations remain. "Proves" would overstate it, while "might possibly" would understate a clear link. Leah keeps a short list of terms with their meaning, so the same word means the same strength each time it appears.

4.6 Drafting and revision

Write a rough draft, then revise for argument, then for sentences, then proofread. Reading aloud catches clumsy phrasing.

Revising in separate passes works because each pass looks for something different: whether the argument holds, whether each sentence is clear, and whether there are typing errors. Trying to do all at once usually catches only the last. Leah leaves a day between drafting and revising so she reads what she wrote rather than what she meant. Reading aloud during the second pass catches sentences that are grammatical but hard to follow.

4.7 Feedback

Peer review between students mirrors technical review in labs: the reviewer checks claims against sources.

Leah and a classmate swap essays and check three things: does each claim have a source, does the source say what the essay claims, and is the conclusion supported? They write comments as questions rather than corrections. In a forensic lab, the same checks are part of technical review, where a second examiner confirms findings before a report is released. Comments phrased as questions keep the review about evidence, not about the writer.

Writing about people

When writing about cases, Leah refers to roles (the user, the administrator) and avoids personal details that the argument does not need. This habit protects privacy in essays and later in reports, and it keeps attention on the evidence rather than on individuals.

Worked example

Leah's first essay on volatility order says: "Memory should always be captured first (Smith blog 2019)." Dr Ferreira asks for the primary source. She revises: "RFC 3227 recommends collecting evidence from most to least volatile, listing registers and cache, then routing tables and memory, before disk (Brezinski & Killalea, 2002)." The word "always" disappears because the RFC presents guidance, not absolute rules.

Synthetic case. The essay is invented.

Errors and limits

Correct citation shows where an idea came from, not that the idea is right; evaluate sources too.

Exercises

Synthesis

Clear structure, primary citations and honest hedging serve both essays and forensic reports.

Continue studying — chapter 04 of 40

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →