The role of key loggers in computer-based assessment forensics

• Authors: R. Laubscher;M. S. Olivier;H. S. Venter;J. H. P. Eloff;D. J. Rabe
• Venue: SAICSIT '05 Proceedings of the 2005 annual research conference of the South African institute of computer scientists and information technologists on IT research in developing countries
• Year: 2005

When conducting a computer-based assessment in an educational environment, several infringements of assessment regulations could arise. Examples are, illegal communication (e.g. by e-mail, web or cell phone); hiding of computer objects with the aim of accessing or utilising it; impersonation of another student and presenting the assessment material (e.g. file containing answers of WebCT test, files that form part of a programming project) of another student. To determine beyond reasonable doubt that no infringement has taken place, various tools could be utilised. One such a tool, the key logger, is the subject of scrutiny for this study. Key loggers are considered a type of spyware. Spyware is software that gathers information secretly about a computer's use, usually installed without the user's consent or knowledge, and relays that information, also covertly, back to a third party. This paper reports the results of an explorative experiment applied to computer-based assessments with the aim to investigate the role of key loggers in computer-based assessment forensics. This exploratory experiment was conducted during computer-based assessments of different groups of students in different subjects. The results include a description of the set up of the controlled environment for the computer-based assessment, execution of the assessment with the accompanying data collection, preserving of the data, analysis of the data, effectiveness of the specific key logger in the forensic process and the conclusions derived from the data.