Review and agenda of Digital Forensics education and training

Abstract

Background:

Digital Forensics (DF) has become increasingly relevant in cybercrime investigations, yet its educational foundations remain fragmented and inconsistently structured.

Methods:

We conducted a systematic mapping study of 49 primary studies on DF education and training, examining course scope, subareas, teaching methodologies, syllabi, materials, infrastructure, assessment practices, and reported challenges.

Results:

The findings reveal a highly uneven landscape. While undergraduate and graduate programs dominate, professional training is comparatively underexplored. Active and hands-on methodologies are emphasized, but few studies provide explicit objectives, standardized curricula, or openly shared resources. Emerging domains such as cloud, mobile, and IoT forensics remain underrepresented, and guidelines for laboratory deployment and assessment practices are rarely documented.

Conclusion:

To address these gaps, we propose a research agenda emphasizing standard knowledge baselines, virtualization of labs, broader dissemination of training practices, open educational resources, expansion into new DF subareas, and the adoption of rigorous, reproducible experimental approaches. These actions aim to strengthen the consistency, practice-orientation, and scientific rigor of DF education and training.