Integrating Digital Forensic Readiness Into Educational Technology: A Framework For Secure AI-driven Learning Environments

As digital platforms become central to modern education, traditional classrooms have shifted toward technology-enabled environments. However, this transition has also exposed institutions to critical risks, including academic misconduct, unauthorized data access, and sophisticated cyber incidents. Currently, most educational frameworks lack the structured forensic capabilities needed to investigate these breaches effectively. This research proposes an integrated security framework that bridges the gap between Educational Technology (EdTech) and Digital Forensics. Instead of general monitoring, the study utilizes machine learning classifiers to identify anomalous behavioral patterns in student interaction logs and live network traffic. During the experimental phase, network traffic was captured on a wireless interface (wlan0) using Wireshark. The PCAPNG data was transformed into a structured CSV format using tshark. A custom Python-based machine learning script (anomaly.py) was deployed, analyzing 1,185 total packets in a normal baseline scenario, identifying 59 distinct anomalies. To further validate the framework, an Nmap attack simulation was conducted, generating a stress-test dataset of 15,138 packets, from which the Isolation Forest algorithm detected 757 anomalies. When a potential threat is flagged, the system transitions into a forensic phase, employing tools like Autopsy to conduct a detailed analysis of artifacts and file system metadata. By documenting a clear Chain of Custody within the learning management system, the framework ensures that digital evidence remains tamper-proof and ethically sound. The findings demonstrate that implementing Forensic Readiness allows educators to move beyond simple detection, providing a transparent and systematic method for incident response.