Computer Science · Grade 11

Active learning ideas

Digital Forensics and Incident Response

Active learning works well for digital forensics because students need to internalize procedural steps and ethical considerations through hands-on practice. By moving between stations, designing plans, and analyzing mock evidence, they engage with the material in ways that lectures and readings cannot replicate.

• Ontario Curriculum Expectations
• CS.HS.S.6

• 30–50 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Stations Rotation
• 45 min · Small Groups

Stations Rotation: Forensics Phases

Create five stations for preparation (tool setup), identification (log review), containment (network isolation sim), eradication (malware scan), and recovery (backup restore). Small groups rotate every 8 minutes, documenting actions and evidence at each. Debrief as a class on chain of custody.

Explain the steps involved in a typical digital forensics investigation.

Facilitation Tip

During the Station Rotation, circulate and ask guiding questions to ensure students connect each phase to real-world consequences, such as, 'What happens if you skip containment?'

What to look for

Present students with a scenario: 'A company server shows signs of unauthorized access. List the first three steps a digital forensics investigator should take, and briefly explain why each is important.'

• Remember
• Understand
• Apply
• Analyze
• Self-Management
• Relationship Skills

Activity 02

• Case Study Analysis
• 30 min · Pairs

Pairs: Incident Response Plan Design

Provide a breach scenario like phishing data theft. Pairs outline a plan covering containment steps, stakeholder notifications, and recovery timelines. They present drafts for peer feedback, refining based on ethical and legal checks.

Analyze the ethical considerations when collecting and analyzing digital evidence.

Facilitation Tip

For Incident Response Plan Design, provide a template with clear sections so students focus on content rather than formatting, and set a timer for peer feedback rounds.

What to look for

Pose the question: 'Imagine you discover sensitive personal information on a suspect's device during an investigation. What ethical considerations must you balance with the need to collect this evidence? How might laws like PIPEDA influence your actions?'

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Activity 03

• Case Study Analysis
• 50 min · Small Groups

Small Groups: Mock Evidence Analysis

Distribute simulated evidence files (logs, screenshots). Groups use free tools like Autopsy to analyze, verify hashes, and reconstruct events. They write a report on findings and response recommendations.

Design a basic incident response plan for a small organization after a data breach.

Facilitation Tip

In Mock Evidence Analysis, assign specific roles like 'log analyst' or 'file recovery specialist' to ensure everyone contributes meaningfully to the group's findings.

What to look for

Ask students to define 'chain of custody' in their own words and explain why it is crucial for digital evidence. Then, have them name one tool used in digital forensics and its primary function.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Activity 04

• Case Study Analysis
• 35 min · Whole Class

Whole Class: Ethical Debate Simulation

Present dilemmas like searching employee devices without consent. Class votes, then debates in guided format, citing laws. Vote again post-discussion to show shifted perspectives.

Explain the steps involved in a typical digital forensics investigation.

Facilitation Tip

During the Ethical Debate Simulation, assign roles in advance to balance viewpoints and require students to cite specific laws or policies in their arguments.

What to look for

Present students with a scenario: 'A company server shows signs of unauthorized access. List the first three steps a digital forensics investigator should take, and briefly explain why each is important.'

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

A few notes on teaching this unit

Experienced teachers approach this topic by emphasizing the importance of procedural accuracy and ethical mindfulness. Avoid rushing students through the phases, as the sequence itself is a core learning outcome. Research shows that guided practice with immediate feedback improves retention of forensic procedures. Use real-world case studies to illustrate why skipping steps or ignoring ethics can invalidate investigations.

Successful learning looks like students correctly sequencing investigation phases, identifying key evidence types, and justifying their actions with ethical and legal reasoning. They should also demonstrate collaboration by refining plans and debating viewpoints respectfully.

---

Watch Out for These Misconceptions

• During Station Rotation: Forensics Phases, watch for students who gloss over the isolation step and move directly to deletion.

  Use the station cards to prompt them with, 'What happens to the evidence if you delete now? How does containment protect it?' Have peers role-play the consequences of premature deletion.

• During Small Groups: Mock Evidence Analysis, watch for students assuming all deleted files are recoverable.

  Provide a disk image with intentionally overwritten files. Have students attempt recovery and compare their results to unaltered files, then discuss when data is truly unrecoverable.

• During Whole Class: Ethical Debate Simulation, watch for students underestimating the legal requirements for evidence collection.

  Reference the debate prompt to ask, 'What law or policy would protect you from a tampering charge here?' Provide a quick reference sheet of key statutes to guide their arguments.

---

Methods used in this brief

• Stations Rotation
• Case Study Analysis