This module is a resource for lecturers
Possible class structure
The following is a recommended structure for the class. Students should complete the required readings before coming to class. The lecture is meant to reinforce what they learned in the readings and the exercises are designed to apply what they learned in the readings and the lecture. The following breakdown is designed for a three-hour class. Lecturers can adapt the structure based on their needs and class times.
Introduction and learning outcomes
Lecture (10 minutes):
- Provide a brief introduction to the class and its contents
- Identify and discuss the learning outcomes of the class
Legal and ethical obligations
Lecture (20 minutes):
- Identify, analyse, and critically assess legal and ethical obligations of cybercrime investigators and digital forensics professionals
- Have students complete " Homework # 3 Code of Ethics" under the "Student Assessment" section of this Module before class and discuss their findings during the lecture. [*Reminder: This homework needs to be completed before class].
[ Optional: Ask students to complete " Homework # 4 Ethical Considerations in Cybercrime Investigations" under the "Student Assessment" section of this Module before class and discuss their findings during the lecture. *Reminder: This homework needs to be completed before class].
Handling of digital evidence
Lecture (50 minutes):
- Identify essential phases in the digital forensics process
- Describe and critically evaluate the ways digital evidence is identified, collected, acquired, and preserved
- Have your students complete " Exercise # 1 Standard Operating Procedures" under the "Exercises" section of this Module before class and discuss their findings during the lecture. [*Reminder: This exercise needs to be completed before class].
- Ask students to complete " Exercise # 2 Digital Evidence Acquisition" under the "Exercises" section of this Module before class and discuss their findings during the lecture.
[ Optional: For technical courses, have students complete " Homework # 5 Recover Deleted Entries in an SQLite Database" before coming to class and discuss their findings during the lecture].
Break
Time: 10 minutes
Analysis and reporting
Lecture (50 minutes):
- Discuss the processes involved in digital evidence analysis and the reporting of findings based on this analysis
- Assign students to complete " Homework # 1 Analysis" under the "Student Assessment" section of this Module before class and discuss their findings during the lecture.
Digital evidence admissibility
Lecture (40 minutes):
- Examine and apply a framework for assessing the admissibility of evidence in courts
- Have students complete " Exercise # 3 Digital Forensics Expert Qualifications" under the "Exercises" section of this Module before class and discuss their findings during the lecture. [*Reminder: This exercise needs to be completed before class].
[ Optional: Instruct students to complete " Homework # 2 Group Assignment: Accreditation of Digital Forensics Laboratories" under the "Student Assessment" section of this Module before class and discuss their findings during the lecture. Students can either hand in a one- to three-page summary of their findings or merely come prepared to discuss their findings in class].
Next: Core reading
Back to top