This module is a resource for lecturers

Possible class structure

The following is a recommended structure for the class. Students should complete the required readings before coming to class. The lecture is meant to reinforce what they learned in the readings and the exercises are designed to apply what they learned in the readings and the lecture. The following breakdown is designed for a three-hour class. Lecturers can adapt the structure based on their needs and class times.

Introduction and learning outcomes

Lecture (10 minutes):

• Provide a brief introduction to the class and its contents
• Identify and discuss the learning outcomes of the class

Digital evidence

Lecture (30 minutes):

• Discuss data and identify data sources
• Describe and discuss digital evidence
• Compare and contrast the differences between digital evidence and traditional evidence
• Discuss the ways in which digital evidence is authenticated

Class Exercise (20 minutes):

• Use the questions under the " Exercise # 1 - About Data" to facilitate discussion on the topic. [*Reminder: This exercise needs to be completed before class].

Class Group Exercise (20 minutes):

• Have students complete " Homework # 1 - Group Exercise: Traditional Evidence vs. Digital Evidence" before class and have them discuss their findings during the lecture. [*Reminder: This exercise needs to be completed before class].

Break

Time: 10 minutes

Digital forensics

Lecture (30 minutes):

• Describe and critique digital forensics process models

Standards and best practices for digital forensics

Lecture (40 minutes):

• Critically evaluate standards and good practices for digital evidence and digital forensics

Class Exercise (20 minutes):

• Use the questions under " Exercise # 2 - Digital Forensics Tools" to facilitate discussion on the topic. [*Reminder: This exercise needs to be completed before class].

Next: Core reading

Back to top