Chapter 8 — Defense and publication plan | Doctoral research Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 8 — Defense and publication plan

Lesson map

Lesson 08 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 The defence"]
  N2["8.2 Likely questions"]
  N3["8.3 Publications"]
  N4["8.4 Practitioner outreach"]
  N5["8.5 Future agenda"]
  N6["8.6 Responsible communication"]
  N7["8.7 After the defence"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 The defence"]
  N2["8.2 Likely questions"]
  N3["8.3 Publications"]
  N4["8.4 Practitioner outreach"]
  N5["8.5 Future agenda"]
  N6["8.6 Responsible communication"]
  N7["8.7 After the defence"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]

[Learning outcomes]
    |
    v
[8.1 The defence]
    |
    v
[8.2 Likely questions]
    |
    v
[8.3 Publications]
    |
    v
[8.4 Practitioner outreach]
    |
    v
[8.5 Future agenda]
    |
    v
[8.6 Responsible communication]
    |
    v
[8.7 After the defence]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) prepare a doctoral defence in digital forensics; (2) anticipate method, legal and ethical questions; (3) plan publications and practitioner outputs; (4) define a post-doctoral research agenda.

8.1 The defence

Twenty-five minutes: problem, contribution, generator, pilot, main results with intervals, validation, limits, impact. Examiners probe method and claims. Ines rehearses twice with Prof. Achebe and once with lab peers playing hostile examiners. She keeps one slide for the 10% interval overlap, because she expects that question, and puts the plain-language meaning of 0.58 recall next to the main results table. The presentation ends with the limits rather than the impact, so that the last thing examiners see is the boundary of the claim.

8.2 Likely questions

Why header/footer as baseline? Because it is widely described and its assumptions are explicit. Why JPEG-like files? Prevalent and well-defined structure. How realistic are images? Answer from the realism sub-study. Could a defence lawyer use your work against an examiner? Yes, if a laboratory relies on an unvalidated tool; that is a reason for laboratories to validate, not a flaw in the research. Ines prepares a one-line answer for each and a pointer to the page where the evidence sits.

8.3 Publications

A journal article on method and results; a short paper describing the generator for dataset reuse; a practitioner note explaining what the error rates mean and do not mean. Each output has a different audience. The article must show method and intervals for reviewers; the generator paper must explain inputs and seeds so others can reuse it; the practitioner note must say, in plain words, that the figures apply to header/footer carving on synthetic images and do not rate any commercial tool. All three cite the same archive version, so figures in the practitioner note can be traced to the same runs as the article.

8.4 Practitioner outreach

Offer the generator to laboratories for their own validation exercises, consistent with ISO/IEC 27041 guidance on using external testing within a validation process. The offer comes with a short guide explaining how a laboratory can set fragmentation levels that resemble its own casework and score its own carver against the manifests. Ines makes clear that the laboratory, not her study, is responsible for deciding whether its tool is fit for purpose. The guide also states which properties of real media the generator does not model, so laboratories know what their own checks must cover.

8.5 Future agenda

More file types; realistic file-system layouts; reassembly methods; examiner agreement studies on interpreting partial recoveries. Each item comes from a limit she reported. Adding file types answers the single-family limit; realistic layouts answer the realism critique; reassembly methods complete the comparison that the main study left out; and the agreement study addresses how examiners word partial recoveries. Prof. Achebe suggests ordering them by feasibility for a postdoctoral project, starting with the reassembly comparison because the code already exists. Each one reuses the generator and manifests, so it needs no new data.

8.6 Responsible communication

Media may oversimplify ("forensic tools miss 40% of files"). Prepare plain wording with conditions attached. Ines's prepared sentence reads: on synthetic images with 30% fragmentation, a basic carving method recovered 58% of picture files intact. It names the method, the media and the condition. She also prepares an answer to the follow-up question of whether real tools are this weak: her study did not test them, and laboratories should check their own. The university press office receives the sentence before any interview, with the conditions attached.

8.7 After the defence

Address required corrections, deposit the archive with a persistent identifier, and update the README with the final version. Each correction is listed in a table with the examiner's comment, the change and the page. If a correction alters any figure, the scripts are rerun from the tagged archive, the manifest is regenerated, and the old and new versions are both kept. The persistent identifier then points to the final deposited version, which is the one cited in the article and the practitioner note.

Ethics statement

The thesis ends with a statement: no real media, no personal data, no malware handled; generator released openly; results bounded to stated conditions.

Worked example

An examiner asks whether 0.58 recall means carving evidence is unreliable. Ines answers: it means header/footer carving misses many fragmented files on these images; recovered files that match a known hash remain reliable for what they are, and absence of a carved file does not show the file never existed.

Synthetic case. The defence is invented.

Errors and limits

Defences test communication as well as content; rehearse with critical colleagues.

Exercises

EX045 — Baseline defence. Justify header/footer carving as baseline. Rubric: 3 = widely described; explicit assumptions; 2 = one; 1 = easiest; 0 = none.
EX046 — Lawyer question. How should Ines answer the defence-lawyer question? Rubric: 3 = shows need for lab validation, not research flaw; 2 = partial; 1 = evasive; 0 = none.
EX047 — Three outputs. Name three planned publications or outputs. Rubric: 3 = journal article, generator paper, practitioner note; 2 = two; 1 = one; 0 = none.
EX048 — Media wording. Rewrite "forensic tools miss 40% of files" accurately. Rubric: 3 = method, file type, conditions, synthetic; 2 = partial; 1 = unchanged; 0 = none.
EX049 — Absence inference. What does failure to carve a file not show? Rubric: 3 = that it never existed; 2 = partial; 1 = it did not exist; 0 = none.
EX050 — Archive deposit. What happens to the archive after the defence? Rubric: 3 = corrections, persistent identifier deposit, README update; 2 = two; 1 = one; 0 = none.

Synthesis

Defend with precise, bounded claims; plan outputs for researchers and practitioners; and communicate error rates responsibly.

Continue studying — chapter 08 of 08

← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →