◇ OpenCyber Academy
Doctoral research · Chapter 3 · English

Chapter 3 — Original contribution proposal

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Original contribution proposal

Lesson map

Lesson 03 published. Map, example, EX015.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Contribution statement"]
  N2["3.2 Requirements"]
  N3["3.3 Generator specification"]
  N4["3.4 Methods compared"]
  N5["3.5 Risks"]
  N6["3.6 Ethics and safety"]
  N7["3.7 Timeline"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX015"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Contribution statement"]
  N2["3.2 Requirements"]
  N3["3.3 Generator specification"]
  N4["3.4 Methods compared"]
  N5["3.5 Risks"]
  N6["3.6 Ethics and safety"]
  N7["3.7 Timeline"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX015"]

[Learning outcomes]
    |
    v
[3.1 Contribution statement]
    |
    v
[3.2 Requirements]
    |
    v
[3.3 Generator specification]
    |
    v
[3.4 Methods compared]
    |
    v
[3.5 Risks]
    |
    v
[3.6 Ethics and safety]
    |
    v
[3.7 Timeline]
    |
    v
[Worked example] --> [Exercise EX015]

Learning outcomes

You will (1) write a doctoral proposal for a forensic-method contribution; (2) define requirements in the language of ISO/IEC 27041; (3) specify a ground-truth dataset generator; (4) plan risks and ethics.

3.1 Contribution statement

"I will produce an openly available synthetic image generator with controlled fragmentation, and interval estimates of carving recall and precision for header/footer and reassembly methods, so that examiners can state method error rates under declared conditions." Each clause of the statement can be checked at the defence: whether the generator is public, whether intervals are reported for each condition and method, and whether the conditions are declared. Ines avoided words such as better or accurate because they cannot be tested without a stated comparison and measure. The statement was revised once, when the reassembly comparison moved to future work, and both versions are kept in the log.

3.2 Requirements

Following ISO/IEC 27041, Ines writes functional requirements (the method recovers files whose bytes are present), non-functional requirements (runtime, repeatability) and acceptance criteria (for example, recall interval reported for each condition). The acceptance criteria make the requirements testable. A run is accepted only if the scorer reads every manifest, every carved file is hashed, and the recall interval is printed for each condition. A run that fails any of these is rerun rather than repaired by hand, and the failure is recorded in the analysis log with its cause.

3.3 Generator specification

Inputs: file types, sizes, count, fragmentation rate, noise type, random seed. Outputs: image bytes and a ground-truth manifest listing each file's byte ranges and SHA-256 hash. The same seed must reproduce the same image exactly. The manifest is the ground truth that makes recall exact. Because it lists each file's byte ranges, the scorer can also say why a file was missed, for example that it was split into fragments or that its footer was lost. Ines tests the reproducibility promise by generating one image twice from the same seed and comparing the SHA-256 hashes of both images before the pilot begins.

3.4 Methods compared

Header/footer carving as baseline; a reassembly approach that tests candidate fragment orders. Both are implemented from published descriptions; any third-party tool is identified by version. Writing both methods from published descriptions keeps the comparison transparent: every assumption, such as the maximum file size the baseline will carve, appears in code that examiners can read. Ines records those parameters in the same file as the seeds, so the archive shows exactly which settings produced each figure. A third-party tool, if used for checks, appears with its version and the date it was obtained.

3.5 Risks

The generator may be too simple; mitigate by comparing artefact statistics with published descriptions of real media. Reassembly may be slow; set time limits. A further risk is a scorer error that makes the method look better or worse than it is. Her mitigation is the pilot on a small image whose truth she can check by hand, plus a second laboratory rerunning the study. Each risk has an owner and a review date in her plan, and Prof. Achebe reviews the risk table at each supervision meeting until the main study ends.

3.6 Ethics and safety

No real media; no personal data; no malware. Code released under an open licence. These choices also simplify ethics review and release. Because the images are generated, nothing in them needs to be redacted before publication, and other laboratories can receive the full dataset. Ines still lists the boundary in her ethics application and in the thesis so a reader knows the result covers synthetic media only, and that no reader should apply it unchanged to casework. An open generator lets critics test her claims on their own seeds.

3.7 Timeline

Six months generator and pilot; eight main study; four writing and archive; six defence and publication. The plan totals twenty-four months, matching the two-year programme. Ines adds checkpoints: the pilot must pass before the main study starts, and the second laboratory's rerun must finish before writing ends, because the validation chapter depends on it. If the generator slips, the writing period absorbs the delay rather than the defence date, which the department sets well in advance. Background and pilot chapters are drafted during the main study.

Dissemination plan

The proposal names outputs: the generator and its manifests released openly, a validation report usable by laboratories, and journal papers. Laboratories accredited to forensic quality standards need method error rates they can cite; designing outputs for them from the start increases impact.

Worked example

The committee asks how Ines will show the generator is realistic. She adds a sub-study comparing fragment-size distributions in her images with published file-system descriptions, and states that realism claims will be limited to those measured properties.

Synthetic case. The committee exchange is invented.

Errors and limits

Proposals change; keep a dated change log.

Exercises

Synthesis

State a testable contribution, write requirements and acceptance criteria, specify a reproducible generator and plan realism checks.

Continue studying — chapter 03 of 08

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →