Cybersecurity asks how a system was compromised. Digital forensics asks what the evidence can tell us. My research starts a little earlier: with the person holding the device.
As an international student and cybersecurity practitioner, I have seen how online fraud and scams affect people who are unsure how to respond or preserve evidence.
In that moment, fear, shame or self-blame can sit alongside an urgent wish to make the incident disappear. A person may delete a conversation, close an account, clear a history or keep a screenshot that tells only part of the story.
These are human responses with possible technical consequences. I want to understand the connection between them.
My ongoing research project examines how psychological reactions and on-device behaviours shape the digital evidence later recoverable in a forensic lab.
The work connects four questions. What influences a person’s response and willingness to report? What do they preserve or delete? How do those actions change recoverable evidence? And what guidance could make the next decision easier?
In controlled scam simulations, I intend to compare the evidence left by different device behaviours. The focus is on completeness, context and quality, alongside what practitioners need to reconstruct an incident.
The aim extends beyond the laboratory. I want to use the findings to design and pilot a brief evidence-capture guide that helps people preserve key artefacts and seek timely help without increasing distress.
The project brings psychological response, forensic recoverability and user-centred guidance into one framework. Its contribution will depend on what the research establishes; the study is ongoing.
For me, this connects a long-running question across public service, product design and security: what does a person need from technology when they are least prepared to deal with it?
Sometimes, the first challenge in digital forensics is not recovering evidence. It is helping people understand what they should preserve.