Digital Forensics Course Development — Phase 1

The first phase of developing a course is creating the course outline; the purpose is to document the curriculum at the course level and to support the learning process by identifying course learning requirements. It will also be used to highlight evaluation methods, learning activities (lectures, demonstrations, etc.), and learning resources (books, blogs, newsletters, etc.).

A course outline is also a legal contract between a school and the students; a teacher is obligated to give the student various opportunities and methods to learning the skills defined within the outline, and the student will be expected to complete the course requirements (assignments, exams, tests, labs, etc.).

The Description

Here we will break it down:

WHY? — Purpose or rationale for the course or subject area covered. This should be done in the first sentence. Ex: Digital Forensics is an indispensable tool to reconstruct the process used for any security breach or to help determine what was compromised.

WHAT? — Key content, principles, and topics to be learned. This is your second sentence. Ex: Specialized techniques, tools, and ethical analysis, along with deep understanding of the affected technologies, are employed to answer the digital forensic questions to understand what happened. Students will develop skills in digital forensic techniques and tools used in investigations of cybercrimes or corporate policy violations.

HOW? — These are the types of major learning activities and student experiences in the course. It should be the last sentence and list things like case study, mock interviews, groups discussions, etc. Ex: In lab-based scenarios, students apply forensic methodology and techniques, analyze evidence acquisition and handling, and interact with law enforcement using forensic best practices.


The VLOs are defined at a program level and agreed upon by the board of education, and thus are mostly pre-defined prior to starting. They are validated by the course and each VLO is either taught, assessed, culminated (capstone project), or a combination.

Examples are as followed:

VLO #— Perform various types of cyber analysis to detect actual security incidents and suggest solutions.

VLO # — Plan and conduct disaster recovery, forensic investigations and incident responses to support Business Continuity of an organization.


A Course Learning Requirement (CLR) is a single-sentence statement that describes learning that integrates knowledge, skills, and aptitudes that learners achieve by the end of the course. These statements identify the performances that must be demonstrated and verified in order to receive credit for a course. They should relate back to the overarching VLOs connected to the program.

An Embedded Knowledge and Skills (EKS) is a stepping stone to, or subsets of, the CLR. These statements encompass smaller learning segments than CLRs.

They are written in the following structure (they need to be measurable, and defined in purpose):


Here are a couple examples of CLRs and EKSs:

CLR: Convey the steps and process of investigative methodology used in digital forensics. (STEM)

  1. [Recognize](verb) potential sources of evidence during an investigation and incident
  2. [Ensure] (verb) evidence is forensically sound through means of preservation methods that will uphold within Canadian court of law.

CLR: Depict and contrast various digital forensic concepts, technologies, and tools. (STEM)

  1. [Perform](verb) memory forensics by collecting and analyzing RAM captures from various devices and documenting findings.
  2. [Execute] system storage forensics on various devices (physical and logical) and forensic images.

Learning Resources and Activities

Learning activities are also listed here; they are the activities that the student will most likely experience, such as lectures, demonstrations, speakers, assignments, case studies, quizzes, tests.. you can be as creative as you want. Make it as interactive as possible. Students aren’t very keen on sitting for 3 hours listening to a lecture when they can be more productive by enhancing their other useful IT skills, such as soft skills (teamwork, problem-solving, detail orientation, organization, empathy, etc.).

This isn’t a very fancy section, as the activities and resources just need to be listed in bullet format. Ex:

Recommended Resources: Additional readings, supplemental resources, case studies, and learning technologies will be provided.

Hardware and Software: Portable Laptop with the minimum requirements:

  • Operating System: Windows 10
  • CPU: 2.0GHz or faster
  • RAM: 4GB or more
  • Free Disk Space: min 25GB free space recommended

Software (paid and open source) will be provided and accessed through the Lab.

Predefined Evaluation and Earning Credit

Assignments (30%) — Validates Outcomes: CLR #, CLR #
Final Exam (20%) — Validates Outcomes: CLR #, CLR #

There are numerous ways to validate the outcomes, and students should be provided with multiple ways to show understanding; apart from exams, one could use presentations, quizzes, and practical assessments. The combination of each evaluation type needs to total 100%, and no single evaluation can hold more than 40%.

Next Steps