Practice and theory:mixing labs and small group tutorials

While appropriate for practical topics like SQL, our traditional format of lecture and lab fails to facilitate the discussion of more theoretical database topics with students. This paper describes and analyses the method and effects of adopting a more flexible approach with third year and postgraduate students. Some weeks use supervised labs while in others tutorials are held in seminar rooms, in smaller groups, without the distraction of computers. Requiring tutorials to be prepared in advance allows time to be used effectively, concentrating on more difficult aspects.Initial results, presented in this paper, are encouraging. Many students enjoy tutorials and exam performance has improved dramatically for some. However, as many as 25% of undergraduate students failed to attend a single tutorial, and many of those who did attend came unprepared. Could, and should, this be changed by explicitly assessing tutorials? The paper concludes by investigating approaches reported elsewhere in order to ascertain how the management of tutorials could be improved

Using web-enabled mobile phones for audience participation in database lectures

This paper evaluates the possible benefits of integrating audience response systems through mobile devices. Typically, existing clicker systems use proprietary radio remotes to send votes to a computer and display this information on screen. While proven to be a useful tool in lectures, adoption has been limited due to their up-front costs. Using mobile devices as a replacement is discussed as an alternative method by making it less intrusive and rootless. A prototype system was implemented to test these assumptions and was evaluated in a typical lecture with undergraduate students studying ‘Database Fundamentals’. The students chose between this system and a typical clicker system and were asked to answer identical quizzes. While their feedback shows little benefit of the prototype over traditional systems, the mobile system offers tangible benefits to the lecturer in speeding up preparation of quizzes and setup time

Contemporary database topics:learning by teaching

Passive learning is generally believed to be ineffectual in that it leads to a generally impoverished student experience manifested by poor attendance, engagement and motivation alike. A shift towards a more pro-active learning experience was therefore the main motivator for the proposed method outlined in this paper. The method adopted was applied to a single module for a cohort of postgraduate, mainly international students. In our method, each student is charged with delivering a specialist database topic as part of an allocated group. They self-organise their group into two sub-groups for lecture and tutorial delivery respectively. Staff support the process by delivering the teaching in the first half of the module. The second, student-led phase is staff-supported using preparatory meetings to discuss content and presentation issues prior to delivery. Feedback overall indicates that the method is effective, particularly in confidence building. We believe that the latter more than compensates for the one or two concerns raised about the quality of information being received. We conclude by discussing a number of changes based on two years’ experience and student feedback

Online learning and fun with databases

In this paper, we explore how online learning can support face-to-face teaching in fundamental database theory and the contributions it can make towards motivating and enhancing the student learning experience. We show how we have used WebCT for a third level database module and present student feedback to our approach. While online participation is high overall, motivation for self-learning is increased by the use of self-assessment exercises and summative assessment was also considered to be more fun online than using paper based equivalents. Evidence exists to link greater online participation of course materials to improved performance. We complement our feedback by presenting and discussing a number of software tools which help students practice important methods in database systems, including SQL. After evaluating these against known methods for improving student motivation, we suggest ideas for further development of more game-like learning tools

Uses of peer assessment in database teaching and learning

This discussion paper introduces three very different methods and contexts for the use of peer assessment in introductory database classes, each of which is supported by different learning software tools. In the first case study, at Glasgow Caledonian University, Contributing Student Pedagogy is used, where students contribute to the learning of others through the collaborative creation of a bank of self-assessment questions. This is supported by the Peerwise software tool. Secondly, at the University of Strathclyde, students undertake formative assessment of others in providing feedback on an initial element of a larger coursework assessment. A number of virtual learning environments (VLEs) are capable of supporting this method through customisable discussion fora. Finally, at the Abertay University, peer and self assessment are used in a group project to adjust the group grade for individual students. This is effected through the use of the WebPA software tool

On the digital forensic analysis of the Firefox browser via recovery of SQLite artifacts from unallocated space

A technique and supporting tool for the recovery of browsing activity (both stored and deleted) from current and recent versions of the Firefox web-browser is presented. The generality of the technique is discussed: It is applicable to any software that uses the popular SQLite embedded database engine such as the Apple Safari web-browser and many Android apps

Fast Filtering of Known PNG Files Using Early File Features

A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algorithms such as SHA256, for each image on a given media, comparing individual digests with a database of known contraband. However, the large capacities of modern storage media, and increased time pressure on forensics examiners, necessitates that more efficient processing mechanisms be developed. This work describes a technique for creating signatures for images of the PNG format which only requires a tiny fraction of the file to effectively distinguish between a large number of images. Highly distinct, and compact, such analysis lays the foundation for future work in fast forensics filtering using subsets of evidential data

Fingerprinting JPEGs With Optimised Huffman Tables

A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algorithms such as SHA256, for each image on a given medium, and comparing individual digests with a database of known contraband. However, the large capacities of modern storage media and time pressures placed on forensics examiners necessitates the development of more efficient processing methods. This work describes a technique for fingerprinting JPEGs with optimised Huffman tables which requires only the image header to be present on the media. Such fingerprints are shown to be robust across large datasets, with demonstrably faster processing times

Fast Forensic Triage Using Centralised Thumbnail Caches on Windows Operating Systems

A common investigative task is to identify known contraband images on a device, which typically involves calculating cryptographic hashes for all the files on a disk and checking these against a database of known contraband. However, modern drives are now so large that it can take several hours just to read this data from the disk, and can contribute to the large investigative backlogs suffered by many law enforcement bodies. Digital forensic triage techniques may thus be used to prioritise evidence and effect faster investigation turnarounds. This paper proposes a new forensic triage method for investigating disk evidence relating to picture files, making use of centralised thumbnail caches that are present in the Windows operating system. Such centralised caches serve as a catalogue of images on the device, allowing for fast triage. This work includes a comprehensive analysis of the thumbnail variants across a range of windows operating systems, which causes difficulties when detecting contraband using cryptographic hash databases. A novel method for large-scale hash database generation is described which allows precalculated cryptographic hash databases to be built from arbitrary image sets for use in thumbnail contraband detection. This approach allows for cryptographic hashes to be generated for multiple Windows versions from the original source image, facilitating wider detection. Finally, a more flexible approach is also proposed which makes novel use of perceptual hashing techniques, mitigating issues caused by the differences between thumbnails across Windows versions. A key contribution of this work demonstrates that by using new techniques, thumbnail caches can be used to robustly and effectively detect contraband in seconds, with processing times being largely independent of disk capacity

A RAM triage methodology for Hadoop HDFS forensics

This paper discusses the challenges of performing a forensic investigation against a multi-node Hadoop cluster and proposes a methodology for examiners to use in such situations. The procedure's aim of minimising disruption to the data centre during the acquisition process is achieved through the use of RAM forensics. This affords initial cluster reconnaissance which in turn facilitates targeted data acquisition on the identified DataNodes. To evaluate the methodology's feasibility, a small Hadoop Distributed File System (HDFS) was configured, and forensic artefacts simulated upon it by deleting data originally stored in in the cluster. RAM acquisition and analysis was then performed on the NameNode in order to test the validity of the suggested methodology. The results are cautiously positive in establishing that RAM analysis of the NameNode can be used to pinpoint the data blocks affected by the attack, allowing a targeted approach to the acquisition of data from the DataNodes, provided that the physical locations can be determined. A full forensic analysis of the DataNodes was beyond the scope of this project