1. Read the case brief.
2. Inspect evidence across Devices, Accounts, and Network.
3. Select up to seven clues. Some true facts are irrelevant.
4. Lock the clues and choose the theory they best support.

Your summary separately shows clue precision and how much relevant evidence you found.

Grades: 6–12. Run time: about 14–18 minutes.

Discussion question: Why can a true fact still be irrelevant to an investigation?

All cases are fictional and defensive. There are no real companies, people, breaches, malware names, CVEs, exploit steps, malicious payloads, personal distress, or stored results.