◇ OpenCyber Academy
Master's · Chapter 1 · English

Chapter 1 — Research question and literature method

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 1 — Research question and literature method

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 From backlog to question"]
  N2["1.2 Properties of a good question"]
  N3["1.3 Search method"]
  N4["1.4 Screening"]
  N5["1.5 Judging sources"]
  N6["1.6 Primary versus secondary"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 From backlog to question"]
  N2["1.2 Properties of a good question"]
  N3["1.3 Search method"]
  N4["1.4 Screening"]
  N5["1.5 Judging sources"]
  N6["1.6 Primary versus secondary"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]

[Learning outcomes]
    |
    v
[1.1 From backlog to question]
    |
    v
[1.2 Properties of a good question]
    |
    v
[1.3 Search method]
    |
    v
[1.4 Screening]
    |
    v
[1.5 Judging sources]
    |
    v
[1.6 Primary versus secondary]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes

You will (1) turn a casework problem into a researchable question; (2) search and screen forensic literature systematically; (3) judge the quality of a source; (4) record the search so others can repeat it.

1.1 From backlog to question

Tomás Lindqvist works part-time in a police digital forensics unit while studying at the fictional Ridgeway University. His unit has a backlog: seized laptops wait weeks because examiners review thousands of operating-system files. Garfinkel (2010) argued that growing data volumes are a central challenge for forensic research. Tomás's problem is real, but "fix the backlog" is not a question. He narrows it: by what proportion does known-file filtering against a reference hash set reduce the files an examiner must review, and what does it miss?

1.2 Properties of a good question

It is answerable with data he can lawfully obtain, measurable (a proportion, an error count), bounded (one file-system type, one reference set) and useful to practitioners. Tomás's question meets each test: images he builds himself can be used lawfully, reduction and misses can be counted, the study is limited to one file system and one version of the NSRL, and examiners in his own police unit filter casework this way every week. Dr Osei asks him to write the question so that each of these properties is visible in it.

1.3 Search method

He searches Digital Investigation and Forensic Science International: Digital Investigation, DFRWS proceedings and NIST publications, with terms such as "known file filtering", "hash set", "triage". He records database, date, terms and hits. Recording these details means another researcher can repeat the search and check whether he missed relevant studies. He also follows references from the studies he finds, noting which were added that way. The search log becomes an appendix to the thesis, as the examiners will expect, and he reruns the search before submission to catch any studies published during the project.

1.4 Screening

Titles and abstracts are screened against inclusion criteria (empirical, describes the reference set, reports reduction or error). Each exclusion gets a reason. Writing a reason for each exclusion lets his supervisor check that criteria were applied consistently, not according to whether a paper supported his expectations. Common reasons are that a paper describes a tool without testing it, or reports reduction without naming the reference set. When a decision is unclear, Tomás reads the full text and records what he found. The criteria were written into his protocol before screening began, so they could not drift towards the studies he hoped to include.

1.5 Judging sources

Peer-reviewed empirical work with released data ranks highest; vendor white papers are noted but treated as claims. The NIST National Software Reference Library (NSRL) documentation is primary for what the reference set contains. Ranking sources this way matters for his topic, because vendor material often reports large reductions without describing the images or whether relevant files were missed. Tomás records the type of each source in his tables, so readers can see which figures come from independent studies with data and which are claims. He treats NSRL documentation as authoritative only for what the reference set contains, not for how well filtering works in practice.

1.6 Primary versus secondary

If a review cites a reduction figure, Tomás traces it to the original study before relying on it. In one case, a review gives a reduction figure that the original study reported only for a single image, not as an average. Tomás cites the original with its context rather than repeating the review's summary. Tracing figures to their sources also shows which studies measured misses at all, which is the gap his project addresses. He keeps a note of each figure he traced, its source and any difference he found, and Dr Osei checks a sample of them.

Worked example

His first search returns 212 records; 31 survive title screening; 9 meet all criteria. He tabulates each study's data set, reference set, reduction reported and whether misses were measured. Only three measured misses — his gap.

Synthetic case. Tomás, his unit and his search counts are invented.

Errors and limits

A search limited to English and two journals can miss work; he states that limitation rather than hiding it.

Exercises

Synthesis

A good thesis begins with a narrow, measurable question and a literature search recorded well enough to repeat.

Continue studying — chapter 01 of 08

← Course home · Course chapter index · Chapter 02 (draft) →