school cyberbullying · K–12 IR — methodology

student privacy — FERPA and local-only processing

• confirm authorized need-to-know under district policy before pulling exports
• hash exports (sha-256) before sharing internally — run evidence-manifest-generator first
• discipline codes and alert counts may appear in findings without message content
• rows with student id + incident metadata are ferpa_restricted in vendor shape — treat as sensitive education records
• restorative-conference models are one district option documented here — not prescriptive guidance for staff conversations
• loop designated student services / counsel — this page documents what exports show, not what to say in meetings

the first 10 minutes

1. confirm district authorization and FERPA need-to-know scope before pulling exports.
2. freeze monitor alert window before the teacher disclosure date — do not re-pull after staff interviews.
3. pull gaggle + bark exports for that window (bark csv requires schools+ tier per vendor docs).
4. pull powerschool [Log] quick export or incident-management verification csv for involved student_number tokens.
5. preserve vendor [REDACTED] tokens — never rehydrate chat bodies in tickets or email.
6. run evidence-manifest-generator on every file before analysis.
7. cross-correlate gaggle severity ladder with bark thread_id bursts on the same window.
8. imminent danger → district emergency protocol — this page is not a hotline.

the path

preserve → monitor severity timeline → SIS discipline anchor → classroom audit (optional) → bundle for counsel. merge exports in fatcousin-multi-tool-super-timeline-correlator when multiple csv/json files span the same disclosure window.

1. 1. evidence manifest generator

   inventory every monitor csv, SIS export, and classroom audit with sha-256 hashes before counsel or board review.why first: district IR loses chain of custody when files are emailed. hash before you open severity ladders.

2. 2. gaggle student safety alert export forensic analyzer

   safety management alert export — severity low/medium/high/imminent · harassment/self_harm categories · no public csv dictionary (fixture-anchored).why second: gaggle is often the earliest monitor signal on google workspace chat — start the severity timeline here.

3. 3. bark school edition alert export forensic analyzer

   schools+ tier csv only — concern level 1–5 · thread_id for burst detection · cross-check with gaggle on shared threads.why third: bark exports thread_id — correlate bursts with gaggle rows before opening SIS discipline.

4. 4. powerschool sis audit log forensic analyzer

   accepts [Log] quick export or incident-management verification csv — harassment clusters · privileged_review flags.why fourth: SIS rows anchor student_number to formal discipline — monitors alone are not the IR packet.

5. 5. google classroom audit log forensic analyzer

   classroom stream comments vs timeline — useful when screenshots of benign stream activity are disputed.why fifth: doctored-screenshot claims often need classroom audit timestamps, not monitor alerts alone.

6. 6. schoology audit log forensic analyzer

   class-wall repost and course activity — secondary when schoology is the LMS of record.why sixth: optional — run when schoology exports are in the district evidence set.

7. 7. case report generator

   bundle hashed exports + finding summaries into a pdf timeline for counsel or board packet.why last: one readable package for designated staff who were not in the export pull.

common false leads

• bark free tier csv — schools+ tier only exports csv per vendor docs; free tier monitors without export.
• securly aware equals filter csv — aware alert taxonomy differs from filter activity reports; quarantined content not in standard export.
• goguardian classroom session log — v1 parses flagged activity on chromebooks; session logs are a different admin surface.
• this is the same as cyberstalking — adult multi-platform stalking needs entity-resolver tooling, not district monitor ladders alone.

what we can tell you, what we can't

we can tell you:

• severity ladder counts and thread_id bursts across gaggle/bark exports
• powerschool harassment clusters and privileged_review flags on discipline rows
• sha-256 evidence manifest for district export packs
• local pdf case report from hashed exports

we can't tell you:

• whether mandatory reporting is required — district counsel decides
• rehydrate redacted chat bodies — parsers preserve vendor redaction
• upload student records to fatcousin servers — processing is browser-local only
• prove authorship of anonymous posts from stylometry alone — supporting evidence only

reference investigation

handing it off

• district counsel: evidence manifest + case report pdf + monitor/SIS finding csv exports.
• student services: severity timeline without message content — coordinate restorative steps outside this tool.
• law enforcement (if referred): hashed exports only — do not email unredacted monitor csv.

vertical hub: K–12 education · compare: school cyberbullying vs cyberstalking