Some institutions provide online courses to students to ease the courses’ workload. Online courses can also be
convenient because the online course content management software conducts marking of tests and examinations.
However, a few students could be willing to exploit such a system’s weaknesses in a bid to cheat in online examinations
because invigilators are absent. Proactive measures are needed and measures have to be implemented
in order to thwart unacceptable behaviour in situations where there is little control of students’ conduct. Digital
Forensic Readiness (DFR) employs a proactive approach for an organisation to be forensically prepared for situations
where there is little control over people. This can be achieved by gathering, storing and handling incident
response data, with the aim of reducing the time and cost that would otherwise be spent in a post-event response
process. The problem this paper addresses is that, at the time of writing this paper, there existed no known DFR
architecture that can be used to collect relevant information for DFR purposes, specifically in the course of an
online examination, as described in the standard published by the International Standards Organisation (ISO) and
the International Electrotechnical Commission (IEC) (ISO/IEC 27043:2015) for incident investigation principles
and processes. Due to the lack of DFR architecture, the authors propose an Online Examination Digital Forensic
Readiness Architecture (OEDFRA) that can be used to achieve DFR when online examinations are conducted.
This architecture employs already existing DFR techniques, discussed in the study, to help educational institutions
achieve DFR in online examinations. This architecture, (OEDFRA), when implemented, will be tested in future
research in order to confirm its contribution to the field of DFR.