ForenCity: A Playground for Self-Motivated Learning in Computer Forensics

. Striking a balance between theory and practice in computer forensics education is considered essential to producing successful graduates with the necessary skills to take on cybersecurity challenges in the workplace. Adequately incorporating both such aspects can be particularly challenging, especially in courses or modules o(cid:27)ered within a short time-frame. In such situations, preparing the students will require that they are incentivized to actively engage with the extensive background learning material and remain current on latest developments to correctly grasp the theoretical underpinning of the subject. In this paper, we describe the development of an adventure game to make the learning of applicable theory attractive and relevant. ForenCity takes the form of a web-based scavenger hunt in which students must apply their knowledge of computer forensics and correctly process digital evidence and progress through the game.


Introduction
A signicant challenge that educators encounter when teaching computer forensics is being able to cover the subject matter adequately. Much debate exists on the topic of what content should go into a computer or digital forensics curriculum, with numerous research eorts dedicated to the topic [1,2]. Critics of training-based courses argue that teaching the subject as a series of steps to be followed in a laboratory produces graduates lacking the theoretical underpinning of the tasks involved [2]. Similarly, academics placing too much emphasis on theoretical knowledge may result in digital investigators sorely lacking concerning practical experience [3].
As cyberthreats grow increasingly sophisticated [4], attempts to achieve a cybsersecure society may depend on educators being able to produce professionals suciently skilled in identifying, collecting, preserving, and analyzing digital artifacts [5]. Understanding how cybercriminals operate is essential for informing cybersecurity experts in their tasks [5].
As a branch of computer science, computer forensics naturally requires an understanding of computer systems, their underlying technology, and how these technologies work [2]. This prerequisite knowledge, which not all students may necessarily possess must be met as part of the curriculum. However, in cases where the oering is limited to a short time frame, covering this knowledge may be a luxury that is ill-aorded, prompting students to acquire this knowledge elsewhere either in other modules or by engaging in self-study. Success in computer forensics can, therefore, depend on how educators nd ways to encourage their students in actively taking charge of their learning.
One potential and popular strategy is to adopt a game-based approach and deliver the content so that students learn abstract concepts and explore digital forensic processes and technologies in a much more interactive manner [6].
Such an approach represents an attractive option as the learning process allows students to overcome dierent challenges [7].
A second approach (not unique to computer forensics), is the adoption of blended learning [8] where the best of both physical and digital worlds are combined to deliver education services and grant students greater control over their own studying [9].
The leveraging of mobile technology in several initiatives have demonstrated that the combination of both strategies above can be quite successful. In one case, a teacher was able to take their class on a virtual tour of Africa [10] while another oered users an interactive, guided tour of the less popular points of interest on campus [11].
Inspired by such cases, we propose the development of ForenCity, a mobile adventure game in which players must draw on cross-disciplinary techniques and knowledge to investigate a case. While systems for developing mobile adventures (such as ARIS) already exist, the need to develop our own arose from two shortcomings, namely (i) the need to promote variations and encourage independent problem solving amongst students, (ii) who primarily owned Android smart devices.
This paper thus reports specically on our process of designing and developing such a game, including the game engine. Section 2 describes specic requirements for the use of games in achieving active learning, leading to details of the design of our new game engine in Section 3. Section 4 details the implementation of our game system while Section 5 describes how a particular game oering was presented using ForenCity. Section 6 discusses plans for future implementation improvements to the system while Section 7 concludes the paper.

Designing an Eective Learning Tool
While research is careful to acknowledge that attempts to accurately quantify the ecacy of games in learning remain immature at best, the overwhelming view regards games in a favorable light, subject to a number of guidelines [12]: Promote social learning and team-teaching permit students to work (and learn) together.
Feedback that is benecial to the attainment of success provide appropriate hints/clues to ensure that students can progress.
Balance between playability and learning outcomes ensure that the game is equally fun to take part in while activities align with appropriate assessment opportunities.
With these requirements in mind, the following section describes the design of the ForenCity Engine that enables us to present to our Computer Forensics students with an opportunity that encourages further self-study and to apply their theoretical knowledge practically.

ForenCity Engine Design
ForenCity consists of two distinct modules: the ForenCity Game Client and ForenCity Maker. ForenCity Maker is the administrative side of the ForenCity Engine to build and manage a ForenCity-based game. The player will interact with the ForenCity Game Client. A basic interface provides the player with feedback as they progress through their adventure.

Design Inuence
First released in May 1984, the Adventure Game Interpreter (AGI) was a highlevel game engine built by Sierra On-Line to build adventure games for series such as King's Quest, Police Quest, Space Quest, and Leisure Suit Larry [13].  [14].
In 1997, Chris Jones released Adventure Game Studio (AGS) that provides the tools to make your own adventure, for free! [15].
All these engines (AGI, SCUMM, and AGS) use locations, characters, items, dialogue, and a basic custom scripting as building blocks to create an adventure.
For the ForenCity Engine, we took the idea of building blocks to create our adventures. Each adventure is broken up into several scenes, each with their description and requirements to complete. Individual players traverse from scene to scene to complete their adventure.

Basic Gameplay Activity
First, a game creator must create several scenes using the ForenCity Maker. Each scene will contain a basic description as well as requirements that players must meet to progress to the following scene. Only players registered on the system will be able to participate in the game. Section 4.1 discusses the ForenCity Maker in greater detail.
The player can now load the ForenCity Game Client by entering the ForenCity URL for the specic adventure. They will be presented with a login page where they can log in with credentials provided to them. Once logged in, the ForenCity Engine will see at which scene the player currently is and load the appropriate scene description.
Based on the scene description, the player can be presented with scene information, describing their whereabouts and progress. If a le is available to be downloaded, the player has access to a Download link. Likewise, if a YouTube video is available, the video will be loaded.
The player now has the option to scan the scene. When a player scans the scene, the game engine will determine their current location (based on their GPS coordinates). If the location matches the required location as set up by the creator, the engine will display a success message. Otherwise, a nothing found message is displayed.
If a follow-up question is required after completing a scene, the client displays the question, prompting the player to answer it. Otherwise, players will automatically progress to the following scene.
Once a player reaches the end of their adventure, they will be presented with a success message.

ForenCity Engine Implementation
ForenCity Game Engine Backend The ForenCity Game Engine (both the Game Client and Maker) is built using PHP with a JSON datastore.
PHP is a widely-used web development scripting language. Many Linux web hosts provide PHP for dynamic websites, with such packages often available on the cheapest packages.
Relational databases (such as MySQL) often come at a premium on webhosts, and so we decided to store the engine's data in JSON (JavaScript Object Notation) les. JSON is a lightweight format (as opposed to XML) and PHP has built-in JSON parsing features. Using JSON comes at the price of not having relational data to easily produce information. However, due to the linear nature of an adventure, it was not seen as a problem.
HTML5 markup was used to render client-side pages. HTML5 includes basic layout structuring but also gave us access to the device's GPS information (this is discussed later).
ForenCity Game Client The ForenCity Game Client is built as a mobilerst web application to allow cross compatibility among many devices. The only requirement is a modern smartphone with an HTML5 compatible web browser, camera, and GPS capabilities. jQuery Mobile 1.4.5 was used to create the user interface for the Game Client.
Even though newer technologies (such as Bootstrap) are available, we believed that jQuery Mobile gave us a more comfortable all-in-one package that immediately produces a web app that looks complete and familiar to a user.
ForenCity Maker ForenCity Maker's only requirement is a modern web browser. Bootstrap 3.3.7 was used to create the user interface that renders on both desktop and mobile devices [16]. The navigation bar and menu give easy access to all modules in the Maker.

ForenCity Maker
The Maker allows a game creator to manage an adventure using three modules: Player Variables For each variable that has been dened in a scene description by the creator, the actual value of the variable can be set for each player. ForenCity Maker provides a simple interface that displays all players and their respective variable denitions to allow a creator to quickly change them.

Download Implementation
Some scenes allow the user to download a le. The le can be specic to the scene or the particular player. Regardless of the le to be downloaded, the lename of the le can be set in the scene description.
Due to the stateless nature of HTTP, a download link can easily be shared between users. We overcame this by generating a unique download link for each player. The link contains a key which consisting of the player's ID and the scene for which the download is available. This key is encrypted using Aaron Francis's Urlcrypt module [17] that produces URL-friendly encrypted strings. When a player selects the download link, the Game Engine will decrypt the URL key. If it is a valid download, the le will be served to the player.

GPS Scene Requirement
An adventure relies heavily on a player's GPS coordinates. Using a browserbased web application, we made use of HTML5's geolocation component [18].
The geolocation component uses the mobile device's location services to obtain the current GPS coordinates. GPS coordinates are then loaded into form inputs and sent to the server.
Browser Requirements Apart from having location services on the device, the user must allow the site to access their location. When rst loading a site that requires geolocating, the browser will prompt the user for permission. A site requesting location information must be loaded via HTTPS. Otherwise, the browser will not even prompt the user for permission.
Obtaining GPS coordinates HTML5 gives two methods to request the current location of a device.
The rst is navigator.geolocation.getCurrentPosition. This method simply asks the device for its current location. The device can then provide the GPS coordinates. However, GPS modules are normally not always running on mobile devices (in order to save power). As such, a once-o location request could potentially be quite inaccurate.
The second available method is navigator.geolocation.watchPosition. The device is now continually polled for GPS coordinates. As the GPS modules are actively running, the accuracy will be improved over a brief period. This does use more battery power, but the requests are only fullled if the site is currently active.
During development, we initially made use of the rst method in order to save power, but found that the accuracy was out far too often, and then opted for the second method.
Using GPS coordinates Using simple JavaScript, the GPS coordinates are loaded into two hidden form elds (latitude and longitude). This location is then submitted along with the form to the server.
The ForenCity Game Engine now received the player's current location according to their mobile device. If the requirement for the player's current scene is a GPS location, the Game Engine will determine if the player's location matches the location requirement. However, this check is not as simple as seeing if the GPS coordinates of the player directly match the GPS coordinates of the scene requirement.

GPS coordinates on consumer devices can often be o by several meters
(especially if attempted indoors). The Game Engine compensates for this by rst calculating the distance between the player's submitted coordinates and the scene's requirement coordinates. If this distance is within a preset maximum radius, the game engine will accept the GPS coordinates. This maximum distance can be set on an adventure-wide level, but can also be overridden on a per-scene basis. This way, indoor scenes can have a more relaxed distance than outdoor scenes as GPS coordinates might be more inaccurate under roof or concrete.
A scene using GPS coordinates is shown as part of the ForenCity Requirements checking in Figure 1

QR Code Scene Requirement
Some scenes need more than GPS coordinates, such as requiring the user to scan a QR code. In these cases, the player will not be presented with the option to Scan for Clues. The scene description should give an indication that something more is required to complete the scene. QR codes can merely contain more information for the player to progress or can be used as proof that a player observed (and handled) a physical item in the real world.
Once a player scans a ForenCity QR code, the ForenCity Engine will rst determine if a valid player is logged in. If not, the player will be presented with the login screen.
Since some scenes may require GPS coordinates in addition to a QR code being scanned, the player will be presented with the option to examine this new clue once the scene has been loaded. This allows the client to submit GPS coordinates to the server as well.
If the QR code is valid for the player's current scene, the Game Engine will perform a GPS check and allow the player to progress. If the QR code is not valid for the scene, the player will be presented with a normal nothing found description.
QR Code Generation The ForenCity Maker provides a QR Code generator that generates a standard URL encoded QR Code. The URL consists of the current adventure's base URL as well as a key consisting of the scene's ID in an encrypted form, once again encrypted using Urlcrypt.

Miscellaneous Functionality
Logging As ForenCity is rst and foremost an implementation for a computer forensics game, it would obviously require that all actions performed by the player are logged. Such information enables us to monitor how each student progresses through the game to unlock the next part of the game. To achieve this, a log le is created that shows exactly what they are attempting. Each log entry includes the current date and time, the player's current IP address, the player's current GPS coordinates and the action that was performed: Player logs in and out. Player loads a scene. Player downloads a le. Player reaches a GPS or QR goal and progresses. Player is presented with and answers a follow-up question. Player attempts but fails, to progress to the next scene. Cheat attempt.  Download Link Sharing Every download link is unique to the player (this enables each player to work with evidence les containing variations unique to that player). If the player shares the link with a fellow player, the ForenCity Engine will not allow the le to be downloaded.
Follow-up Question Hijacking A player could share the form where the follow-up question is asked with a fellow player, in order to potentially bypass an actual GPS or QR code check. Every Follow-up Question form has a unique key for every player. If the key is not present for the correct player, the answer will be rejected.
Having described the various features of ForenCity, the following section will now describe a particular case set up for a group of students.

Solving for a Kidnapping
In 2017, we deputized 15 students as investigators, tasking them to investigate the kidnapping of a mining magnate's young daughter. The case is, in essence, a race against time (although students were given the space of a week to conclude drafting a nal report on how they reached the end goal).
This section showcases select scenes from the game, detailing the activities taking place, and expected outcomes from the students. • Expectations: The student must analyze the email for clues. The student should notice (in their nal report) that the email is from a throwaway address. The attached photograph, however, contains metadata that includes coordinates suggesting Gugu's last known location (when the photograph was taken). If the student is not familiar with how GPS coordinates work, they will now need to research how to decipher the values to visit the location physically. Characters Forensic investigation is not only limited to inanimate objects.
Often interaction (and interrogation) with other people will be required. We want to develop a character component that will include a complete dialogue tree system. Players will have the opportunity to meet with these virtual characters and have interactions with them. Depending on their dialogue choices, characters will either reveal or withhold vital information.
Interactive Objects Forensic investigate will require interaction with objects at a scene. Similar to Characters described above, we want to im- Inventory Often one piece of evidence will lead to more and dierent clues. As the player progresses through their adventure, they should be able to pick up items along the way. Items can then be used alongside other items, objects or even characters.

Conclusion
As seen in our discussion on the various features of ForenCity, we have developed a platform that enables educators to create engaging and customized problembased assessments in the form of an adventure game that takes students beyond the physical classroom. Based on participants' feedback, we enjoyed a rather positive and enthusiastic response from students excited to draw on their computer science and computer forensics knowledge in order to unlock the next clue and reveal how the next chapter in the mystery would unfold.
In ForenCity, we were able to create an environment that augmented physical items and spaces on our institution's campus with virtual characters and props to guide each student through a police investigation that developed as they engaged with both the physical and virtual props around them. Restricted only by our imagination and storytelling skills, ForenCity could potentially be used to assess students on a variety of other cybersecurity skills. Beyond implementing the extra features in ForenCity, we look forward to expanding ForenCity's storyline, inviting students in other subjects to test their mettle while getting to apply and experience the skills and knowledge they have acquired thus far.