Digital Forensics Course Development — Phase 1

6 min readFeb 6, 2021

The first phase of developing a course is creating the course outline; the purpose is to document the curriculum at the course level and to support the learning process by identifying course learning requirements. It will also be used to highlight evaluation methods, learning activities (lectures, demonstrations, etc.), and learning resources (books, blogs, newsletters, etc.).

A course outline is also a legal contract between a school and the students; a teacher is obligated to give the student various opportunities and methods to learning the skills defined within the outline, and the student will be expected to complete the course requirements (assignments, exams, tests, labs, etc.).

The Description

The first part that needs to be created is the course description. It orients students by outlining the rationale for the course subject or theme, framing a brief overview of the key content, knowledge and skills to be learned and stating the major learning strategies and activities that students will experience. Don’t worry, it’s not super complicated.

Here we will break it down:

WHY? — Purpose or rationale for the course or subject area covered. This should be done in the first sentence. Ex: Digital Forensics is an indispensable tool to reconstruct the process used for any security breach or to help determine what was compromised.

WHAT? — Key content, principles, and topics to be learned. This is your second sentence. Ex: Specialized techniques, tools, and ethical analysis, along with deep understanding of the affected technologies, are employed to answer the digital forensic questions to understand what happened. Students will develop skills in digital forensic techniques and tools used in investigations of cybercrimes or corporate policy violations.

HOW? — These are the types of major learning activities and student experiences in the course. It should be the last sentence and list things like case study, mock interviews, groups discussions, etc. Ex: In lab-based scenarios, students apply forensic methodology and techniques, analyze evidence acquisition and handling, and interact with law enforcement using forensic best practices.


The course outline will also define the relationship to Vocational Learning Outcomes (VLO); these capture the learning that is being done at the program level. These are broader statements that include a variety of levels and experiences. The expectation is that this is what the students will achieve by the end of the program.

The VLOs are defined at a program level and agreed upon by the board of education, and thus are mostly pre-defined prior to starting. They are validated by the course and each VLO is either taught, assessed, culminated (capstone project), or a combination.

Examples are as followed:

VLO #— Perform various types of cyber analysis to detect actual security incidents and suggest solutions.

VLO # — Plan and conduct disaster recovery, forensic investigations and incident responses to support Business Continuity of an organization.


So many acronyms… Once the program has established the specific VLOs of the course, the next step is for you as the course developer to define CLRs and EKSs — these are key in helping you create a course syllabus, and skill/knowledge based content, assessments, tests, labs, etc.

A Course Learning Requirement (CLR) is a single-sentence statement that describes learning that integrates knowledge, skills, and aptitudes that learners achieve by the end of the course. These statements identify the performances that must be demonstrated and verified in order to receive credit for a course. They should relate back to the overarching VLOs connected to the program.

An Embedded Knowledge and Skills (EKS) is a stepping stone to, or subsets of, the CLR. These statements encompass smaller learning segments than CLRs.

They are written in the following structure (they need to be measurable, and defined in purpose):


Here are a couple examples of CLRs and EKSs:

CLR: Convey the steps and process of investigative methodology used in digital forensics. (STEM)

  1. [Recognize](verb) potential sources of evidence during an investigation and incident
  2. [Ensure] (verb) evidence is forensically sound through means of preservation methods that will uphold within Canadian court of law.

CLR: Depict and contrast various digital forensic concepts, technologies, and tools. (STEM)

  1. [Perform](verb) memory forensics by collecting and analyzing RAM captures from various devices and documenting findings.
  2. [Execute] system storage forensics on various devices (physical and logical) and forensic images.

Learning Resources and Activities

This area specifies any resources that are required for all course sections including textbooks, software and equipment. Specific weekly learning resources and material (presentations, content, articles, blogs, research papers, etc.) should be communicated to students through a chosen platform. I don’t usually recommend using “Required Textbooks” — as a struggling student, I would usually find a way of finding a free version of the overpriced book “required” for the class (which would only be used a handful of times). Try to supply the students with open source material.

Learning activities are also listed here; they are the activities that the student will most likely experience, such as lectures, demonstrations, speakers, assignments, case studies, quizzes, tests.. you can be as creative as you want. Make it as interactive as possible. Students aren’t very keen on sitting for 3 hours listening to a lecture when they can be more productive by enhancing their other useful IT skills, such as soft skills (teamwork, problem-solving, detail orientation, organization, empathy, etc.).

This isn’t a very fancy section, as the activities and resources just need to be listed in bullet format. Ex:

Recommended Resources: Additional readings, supplemental resources, case studies, and learning technologies will be provided.

Hardware and Software: Portable Laptop with the minimum requirements:

  • Operating System: Windows 10
  • CPU: 2.0GHz or faster
  • RAM: 4GB or more
  • Free Disk Space: min 25GB free space recommended

Software (paid and open source) will be provided and accessed through the Lab.

Predefined Evaluation and Earning Credit

Now that you laid out what the student can expect to learn, and how they will be learning the material, you need to lay out how they will be assessed on their abilities to perform and retain the information. It is a list that provides evidence of the course’s learning achievements and the outcomes they validate. For example:

Assignments (30%) — Validates Outcomes: CLR #, CLR #
Final Exam (20%) — Validates Outcomes: CLR #, CLR #

There are numerous ways to validate the outcomes, and students should be provided with multiple ways to show understanding; apart from exams, one could use presentations, quizzes, and practical assessments. The combination of each evaluation type needs to total 100%, and no single evaluation can hold more than 40%.

Next Steps

The next steps is Phase 2 — the creation of the Course Section Information; a high level visualization of all components and structure of the course. It will provide a guidance on weekly or module learning objectives and align them with weekly assessments, activities, and resources. Stay tuned for the next phase — this is where I’ll be sharing details of the course prior to content creation (Phase 3).