school cyberbullying · K–12 IR
post-incident district IR — correlate gaggle · bark monitor severity ladders with powerschool discipline rows · google classroom/schoology audit · doctored-screenshot metadata. not counseling · not mandatory-reporter trees · student education records stay local.
entry point: gaggle student safety alert export forensic analyzer. work the primary tools top-down — all local, no upload.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this case type.
- gaggle student safety alert export forensic analyzerdrop gaggle safety export · severity ladder · harassment/self-harm clusters · runs locally
- bark school edition alert export forensic analyzerdrop bark for schools csv · concern level 1–5 · thread bursts · runs locally
- powerschool sis audit log forensic analyzerdrop powerschool log or incident csv · discipline gaps · harassment clusters · runs locally
- google classroom audit log forensic analyzerdrop google classroom audit via workspace · parse class + post + grade events · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
also useful · secondary tools
supporting and follow-up tools. surface as the investigation widens.
- schoology audit log forensic analyzerdrop schoology audit · runs locally
- goguardian classroom monitor export forensic analyzerdrop goguardian flagged activity csv · threat_level · flagged_terms · runs locally
- securly aware alert export forensic analyzerdrop securly filter activity csv · blocked/flagged/allowed · policy hits · runs locally
- lightspeed classroom monitor log forensic analyzerdrop lightspeed filter web activity csv · blocked/flagged hits · user bursts · runs locally
- infinite campus sis audit log forensic analyzerdrop infinite campus discipline or audit csv · participation gaps · harassment clusters · runs locally
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
- natural language writing sample authorship comparatordrop multiple text files or paste writing samples · compute 40 plus stylometric features · sentence length distribution · vocabulary richness · function word frequencies · punctuation patterns · produce similarity score with confidence intervals between samples · runs locally
- fatcousin multi tool super timeline correlatordrop any fatcousin findings csv/json · unified timestamp-sorted timeline · runs locally
- fatcousin cross export ioc hash correlatordrop hash/ioc csv from any fatcousin tool · shared indicator intersection report · runs locally
proof & methodology
synthetic reference investigations and investigation playbooks for this case type — fixture-locked goldens, local binders, evidence order, and tool paths.
investigation guide: school cyberbullying · K–12 IR — methodology →
side-by-side: compare case types →
run as a case-kit pipeline
no curated stack for this case type yet. tracked in the forensics rollout — pipelines roll out one case type at a time.