Locard’s principle on forensic evidence is summarized by the mantra “every contact leaves a trace.” While generally discussed in terms of physical evidence left at the scene of a crime, we can likewise state that when people interact with exams and exam questions in abnormal and fraudulent ways they are likely to leave traces of their acts, occurring as irregularities in their answer choices, score patterns, and response times. Data forensics for exam security is the use of statistical trends and analytics to detect these traces of fraudulent behavior. It has successfully been used to detect activity like proxy testing (when the exam is completed by someone other than the test taker), item pre-knowledge (access to active exam questions prior to taking the test), and exam site collusion.
Identifying suspected exam fraud and taking action as early as possible is a crucial component of exam security and the integrity of an exam program. This workshop will provide practical guidance on the types of analyses proven to detect cheating and procedures for identify associated exam questions, exam forms, and candidates for further investigative action. Analyses will range from simple statistical checks that can be easily implemented to more complex methods like score pattern and response similarity analysis. Examples will be presented of results consistent with normal testing behavior as well as results from confirmed incidences of test fraud.