With the growing demand for cybersecurity professionals, many colleges and universities have introduced undergraduate and graduate programs, as well as certificate offerings in the field. Digital forensics, a critical component of any cybersecurity curriculum, involves the extraction of valuable information from network traffic, volatile memory, and file systems.

In this paper, we present two digital forensics exercises designed as clue-hunting activities based on provided digital evidence, including captured network traffic, RAM dumps, and storage device images. We describe the process used to generate the forensic artifacts and illustrate our approach through a detailed example of one of the clue hunts. Our aim is to support fellow educators by offering practical, adaptable materials that can be used to develop laboratory exercises or assessments in digital forensics courses.

Keywords: Education, Digital Forensics, hands-on-activities.