The Use of Digital Forensic Case Studies for Teaching and Assessment Harjinder Singh Lallie School of Computing, University of Derby, Kedleston Road, Derby DE22 1GB h.s.lallie@derby.ac.uk Abstract This study analyses the use and development of Digital Forensic case studies for the purpose of teaching and assessing Digital Forensics students and practitioners. Within this study, case studies are categorised and a number of available case studies are explored. The importance of evidentiary and non-evidentiary artefacts within the case study are examined. Mechanisms for integrating case study development and/or investigation with student assessment are proposed, the benefits and the challenges of this approach are examined. Practical and technical issues involved in the development of case studies are examined. The study concludes by proposing guidelines for the development of Digital Forensic case studies. 1 Introduction Digital Forensic (DF) case studies can be used for:  the teaching and assessment of digital forensic students and practitioners;  testing and validating digital investigations software/tools;  research and development. This study focuses on the use of DF case studies for teaching and assessing DF students and practitioners. DF case studies are enacted on a computer system and represent a particular scenario that requires analysis and/or investigation. The computer storage system(s) on which the case studies have been enacted are subsequently converted to DF images which can then be analysed and investigated using the appropriate tools. The DF Image is a bitstream copy of an original hard disk. The image structure begins with a vendor specific header, is then interspersed with vendor specific control information (such as CRCs) and superceded with a footer. Images