Teach a DFIR lab course without building the labs
A term plan you can drop into a syllabus, how grading works, and the import steps for Canvas, Blackboard, Moodle and D2L Brightspace. Every student gets their own evidence and their own answer key, so answers don't travel between students or semesters.
Install the app and paste your trial key in Settings, Licensing. Import your roster with each student's id set to the identifier your LMS matches on (Canvas SIS Login ID, Blackboard and Moodle username, D2L Username or OrgDefinedId).
Generate the week's case for the roster. Each student gets a zip with their own evidence, plus a link to the student portal where they answer in the browser. You keep the instructor key.
Grade the class in one pass, read the per-question analytics, run the anti-collusion report, and export a grade file for your LMS.
The 14-week forensics term
Introduction to Digital Forensics: Undergraduate, second or third year. About 13 lab hours. The cert topic column shows which certification pathway each case belongs to (GASF, GCFA, GCFE, GCFR, GNFA); that's topic alignment, not endorsement. 9 weeks run free and the trial opens 2 more, so you can teach the first stretch of the term before buying anything.
Free runs on download with no key. Trial opens with the 30-day trial key. Paid plan needs a license; a plan name such as Department means that plan or above.
| Wk | Topic | Case | Level | Mode | Cert topic | Access |
|---|---|---|---|---|---|---|
| 1 | Evidence handling and the registry | First Look: USB Device History | First Look | Practice | GCFE | Free |
| 2 | Program execution | First Look: What Ran on This Machine | First Look | Practice | GCFE | Free |
| 3 | Files the user touched | First Look: Recent Files and Jump Lists | First Look | Practice | GCFE | Free |
| 4 | Persistence | First Look: What Runs at Startup | First Look | Practice | GCFE | Free |
| 5 | Windows event logs | First Look: Accounts and Services in the Logs | First Look | Practice | Free | |
| 6 | Timelines | First Look: Building a Timeline | First Look | Practice | GCFE | Free |
| 7 | Midterm practical | Insider Data Theft via USB | Medium | Timed exam, 75 min | GCFE | Trial |
| 8 | Browser and download forensics | First Look: Suspicious Download | First Look | Practice | Free | |
| 9 | Data exfiltration | The Customer Export | Medium | Practice | GCFE, GCFR | Paid plan |
| 10 | Memory forensics | First Look: What's in Memory | First Look | Practice | GCFA | Free |
| 11 | Code injection in memory | Injected Code in Memory | Hard | Practice | GCFA | Paid plan |
| 12 | Network forensics | First Look: Reading a Packet Capture | First Look | Practice | GNFA | Free |
| 13 | Mobile forensics | The Texts They Deleted | Medium | Practice | GASF | Paid plan |
| 14 | Capstone practical and report | Credential Theft and Lateral Movement | Hard | Timed exam, 120 min, report | GCFE, GCFA | Trial |
Learning outcomes, readings and the grading scheme are in the syllabus PDF. The app's Courses screen generates every week's lab for your roster.
The 8-week incident-response course
Incident Response Fundamentals: Upper undergraduate, graduate, or professional cohort. Worked from EDR, SIEM, email and event-log evidence and graded against MITRE ATT&CK. 3 weeks run free and the trial opens 1 more.
| Wk | Topic | Case | Level | Mode | Access |
|---|---|---|---|---|---|
| 1 | Reading an EDR alert | First Look: Reading an EDR Alert | First Look | Practice | Free |
| 2 | The SIEM queue | First Look: Reading a SIEM Alert | First Look | Practice | Free |
| 3 | Beacons in web traffic | First Look: One Beacon in the Web Traffic | First Look | Practice | Free |
| 4 | Phishing to foothold | Phishing to Foothold | Medium | Timed exam, 45 min | Trial |
| 5 | Malware triage | Malware Triage: From Alert to Verdict | Medium | Practice | Paid plan |
| 6 | Lateral movement | Lateral Move to the File Server | Medium | Practice | Paid plan |
| 7 | Business email compromise | Business Email Compromise: Wire Fraud | Medium | Timed exam, 45 min | Paid plan |
| 8 | Final incident: ransomware | Ransomware Before Coffee | Hard | Timed exam, 90 min, report | Paid plan |
Full outcomes and readings: syllabus PDF.
How grading works
One pass for the whole class
Students answer in the portal, or you collect the grading sheet and import it on the Grading screen. Each answer is checked against that student's own key: hashes case-insensitive, timestamps within seconds, free text fuzzy-matched with a review flag. Every score shows why it was awarded.
What you see afterwards
Mean, median and the score distribution, plus the correct rate per question, so you know what to reteach. The anti-collusion report shows how many distinct answers each question had and which student pairs look most alike.
Reports and rubrics
Turn on the investigation report template and mark each report against the rubric on the Grading screen. The export can blend the report into the lab score (30% by default) or put it in its own column.
Feedback students read
Turn on feedback at export and each student gets a note listing the questions they missed, for example: "Scored 8.0/10.0 (80.0%). Missed 1: q2 (timestamp)."
Importing grades into your LMS
The app hands you a grade file to upload. It doesn't talk to your LMS over the network, so there's nothing for IT to approve. Choose the column name at export so it matches your gradebook, and raw points or percent.
| LMS | File | Matches students by | Steps |
|---|---|---|---|
| Canvas | canvas-grades.csv | SIS Login ID | Gradebook, Import, upload the file. Map it to a new or existing assignment, review, save. The second row carries Points Possible. |
| Blackboard | blackboard-grades.csv | Username | Grade Center, Work Offline, Upload. Map the grade column and submit. |
| Moodle | moodle-grades.csv | username | Course gradebook, Import, CSV file. Map username to the user identifier and the grade column to the grade item. Feedback lands in the feedback column. |
| D2L Brightspace | brightspace-grades.csv | Username or OrgDefinedId | Grades, Import, upload the file. The End-of-Line Indicator column is included. Feedback imports from the added Feedback column. |
| Anything else | grades.csv | student_id | A plain id and score file, plus an optional per-question detail CSV. |
Canvas and Blackboard grade uploads don't carry comments, so export the separate student-feedback.csv for those. You can also export a case as a Common Cartridge (.imscc) module.
Start the term on the trial.
The First Look weeks run free. The trial opens the midterm, the capstone and the phishing exam for 30 days, for up to five students.