Unit 03 of 03
Forensic Examination
Measuring the evidence item: evidence integrity and how many items the chain of custody breaks at, the verifiability of write-blocked copying and the items a partial copy misses, the items lost when order of volatility and collection order go wrong, merging three sources' timelines and the order that clock skew disrupts, the evidence value of a trace extracted from system structures, and presenting technical findings as a claim-to-evidence mapping in the legal context.
Published Updated
Lessons
- 01 Forensic Examination Principles Measuring evidence integrity and chain of custody in items: 28 evidence items, 78 transfers, and five record fields per transfer; 10 of 390 fields left blank puts 9 items in question, and hash mismatches put 3 more in question, leaving 12 of 28 items indefensible. If a single point in the field chain loses its record entirely, 13 items open up at once; the way a 2.6 percent record gap turns into a 43 percent item loss comes from the chain's structure. 14 min read
- 02 Disk Imaging Measuring the verifiability of write-blocked copying: on a fictional 4,096-slice source, a selective directory copy takes 4 of 15 evidence items, a logical copy takes 8, a partition block takes 13, and a full block copy takes all 15. Because the source hash can be recomputed in an offline copy, 15 of 15 items are verified; in a copy taken from a running system, 303 of 4,096 slices change, all three hashes come out different, and the number of verified items drops to 9. 14 min read
- 03 Memory Dump Analysis Establishing an order of volatility and counting the items a collection order costs: 28 evidence items are arranged into 10 volatility classes; with a single collector, the correct order loses 7 items, host-by-host collection loses 12, and largest-item-first collection loses 18. A three-person team following the correct order has 0 losses, a six-person team following the wrong order has 13; the wrong order is also the fastest collection to finish, because a lost item spends no time. The memory dump is relevant to 8 of 12 questions and answers 4 of them on its own. 9 min read
- 04 Timeline Creation Merging the events of three sources onto a single timeline, and how clock skew breaks the ordering: raw merging of 54 events forming 1,431 pairs produces 35 inverted pairs, 33 of the 54 events land in the wrong position, and the largest skew is 243 seconds. Once skew is estimated and corrected using nineteen anchor events, inverted pairs drop to 1, wrong position drops to 2, and the correction changes the position of 34 events. All 35 of the 35 inverted pairs come from two different sources; skew never breaks a source's own internal order. 14 min read
- 05 Structure and Record Examination Measuring the evidentiary value of traces left by system structures: of 12 structures, 7 are in the direct class and 5 are in the inference class, and their bases range from 4 to 187 in a 268-machine fictional fleet. Of seven claims, 2 are distinctive, 4 are weak, and 1 is noise; the claim resting on a single structure is also true on 187 clean machines. A claim with three bases turns out weaker than a claim with two bases when all three bases are in the inference class, and the independence assumption makes the calculation a lower bound. 13 min read
- 06 Reporting Measuring technical findings as a claim-to-evidence mapping: in a fictional 20-claim report draft built on 22 items collected by a three-person shift, 10 claims come out directly supported, 9 are inference, and 1 is unsupported. Seven of the 9 claims counted as inference drop there because of chain-of-custody gaps, and 2 are already inference. Perfect collection yields 11 direct claims, while host-by-host collection with a one-person team drops that to 7 and raises unsupported claims to 3. 14 min read