Time: 70 minutes Outcome: Learners will build an evidence-based timeline and maintain at least two plausible explanations until evidence distinguishes them.
Materials
- Sanitized fictional log set
- Timeline worksheet
- Hypothesis table
- Briefing template
Safety and Privacy
All data are invented. No malware, live target, real account, or personal information is included.
Activity
Learners normalize timestamps, identify relevant events, label statements as fact/inference/unknown, and create two hypotheses. The instructor then provides an additional log entry that supports one hypothesis but does not prove attribution.
Evidence
Timeline, hypothesis table, next-evidence request, and one-minute briefing.
Debrief
- Which early conclusion was tempting but unsupported?
- How did missing logs affect confidence?
- What action could be justified before attribution was known?