Creative Dad CompanyCreative Dad Company
TechnologyMathStorytelling

Digital Forensics Investigation

Log in to save
Grades 9-1290-120 minSource: Creative Dad Company

Students reconstruct a timeline of events from an ethically-designed simulated case file—emails, timestamps, and photos—like a digital detective piecing together what really happened. Perfect for a teen who loves mysteries and paying close attention to detail.

Choose your version

Every level teaches the same core idea — pick the one that fits your time, budget, and energy today.

Prep: 10 minActivity: 30 min1 session~$2/groupOne table for the Digital Forensics Investigation evidence and prototypeBeginner-friendly

Setup

Print or handwrite the four Digital Forensics Investigation challenge steps and place common paper supplies on one table. Prepare one small sample, dataset, scenario, or recycled-material model drawn directly from the project description; no device, paid tool, room decoration, or purchased kit is required.

Activity

  1. Read the Digital Forensics Investigation challenge aloud, then read through a packet of simulated digital evidence—timestamps, messages, and photos—and predict a rough order of events.
  2. Use paper, index cards, recycled objects, or facilitator-provided sample data to build a timeline on a corkboard, pinning each piece of evidence to the moment it supports.
  3. Run one tabletop trial and find two timestamps that contradict each other and dig back through the evidence to figure out which one is unreliable and why.
  4. Finish by present the final reconstructed timeline as a case briefing, clearly separating what's proven from what's still just a theory; record the evidence that supports the decision.

Done when: The group completes a defensible Digital Forensics Investigation solution, records at least one test result or comparison, changes one claim or design in response, and supports its final decision with that evidence.

Materials

printed case file packet, corkboard or poster board, string, push pins, index cards

Shown for the Quick Start version — switch tabs above to see what changes.

Disclosure: Materials links below go to Amazon. As an Amazon Associate, Creative Dad Company earns from qualifying purchases at no extra cost to you.

Steps

  1. Read through a packet of simulated digital evidence—timestamps, messages, and photos—and predict a rough order of events.
  2. Build a timeline on a corkboard, pinning each piece of evidence to the moment it supports.
  3. Find two timestamps that contradict each other and dig back through the evidence to figure out which one is unreliable and why.
  4. Present the final reconstructed timeline as a case briefing, clearly separating what's proven from what's still just a theory.