Digital Forensics / Basic: scope, integrity, and interpretation / Lesson 1

Frame a forensic question and its scope

Turn an ambiguous event into bounded questions, permitted material, and testable observations.

About 4 min readContent reviewed 2026-10-28

On this page

Lesson goals

Separate the investigative question from a preferred explanation.
Describe scope and limitations without claiming actual acquisition or legal admissibility.

Ask what the available material can answer

A fictional training application reports that a workshop record changed unexpectedly. “Who did it?” is broader than the available synthetic logs may support. Begin with smaller questions: which record version appears in each artifact, which event identifiers refer to it, and what sequence is consistent with the recorded times? Separate those observations from identity attribution or intent. A useful question names the artifact, property, and uncertainty. This course creates its own bytes and records; none is acquired from a real device, account, investigation, or organization.

Write the permitted analytical boundary

Scope states which material and questions are authorized, which actions are permitted, and which changes would require a separate decision. A request to explain a synthetic log does not authorize inspecting unrelated user data or contacting a host mentioned in it. The planning record distinguishes created fixtures from actual collection. It is non-runnable and makes no legal determination. In real work, the accountable organization must establish applicable authority and handling requirements through its own approved process; this lesson supplies neither permission nor legal advice.

json A bounded classroom analysis plan

{"case":"LAB-CASE-01","question":"which-fixture-records-reference-workshop-4","material":"author-created-json-records","allowed":"offline-parse-and-compare","excluded":"real-devices-accounts-and-network","acquisitionPerformed":false,"admissibilityAssessment":false}

The record describes a fictional exercise rather than real evidence handling. Its case id is local. No device is accessed and no acquisition, account operation, network request, or admissibility assessment occurs.

Keep filtering distinct from interpretation

A reproducible first step can select records that explicitly reference the workshop. The program checks that two matching event ids are selected while an unrelated record is excluded. It does not prove the source is complete or that the actor field identifies a human. Filtering answers a narrow question about the supplied fixture. Preserve the exact input and selection rule so another reader can repeat it. Avoid silently removing malformed or ambiguous records; record their disposition separately because exclusion can alter a later timeline or count.

python Select explicit references in invented records

records = [{"event":"e1","workshop":"workshop-4"}, {"event":"e2","workshop":"workshop-9"}, {"event":"e3","workshop":"workshop-4"}]
selected = [r["event"] for r in records if r["workshop"] == "workshop-4"]
assert selected == ["e1", "e3"]
assert "e2" not in selected
print("two fixture references selected")

Expected output

two fixture references selected

The complete program filters a three-record local list. The result is an exact property of this fixture, not a finding about a real incident, user, or system. No source collection or external lookup is performed.

Distinguish examination, analysis, and reporting

Examination extracts and organizes relevant information; analysis evaluates what that information supports in context; reporting communicates methods, findings, and limitations. The boundaries can interact, but they should remain understandable. A parser returning a field is not the same as an explanation of why the field exists. Record alternative interpretations and the next observation that could distinguish them. An empty result may mean no matching record in the supplied material, a parsing defect, incomplete retention, or an incorrect query. Do not collapse those possibilities into a confident narrative.

Use a conclusion proportional to the observation

For this exercise, the defensible conclusion is that two supplied records reference workshop-4 under the stated comparison. It is not proof that only two events occurred or that a named person changed anything. Include the fixture identity, method, output, and missing context. A good report can answer part of the question while leaving attribution or completeness unresolved. This restraint is analytical precision, not a failure to investigate. It prevents later reviewers from treating a convenient local computation as evidence of events beyond the material actually examined.

Common errors and fixes

A preferred suspect determines the question

Why it happens: Interpretation precedes examination of the material.
How to fix it: Write observable artifact questions and competing explanations.
Prevent it next time: Separate observations, hypotheses, and attribution.

A host in a log is contacted automatically

Why it happens: Analysis scope is expanded into an unauthorized action.
How to fix it: Keep the exercise offline and resolve actual authority separately.
Prevent it next time: Record permitted actions and excluded material.

Two selected records are called two total events

Why it happens: Fixture selection is confused with source completeness.
How to fix it: Qualify the conclusion by material and method.
Prevent it next time: State retention and completeness limitations.

Check your understanding

1. The filter returns no workshop-4 records. Write an accurate conclusion.

Show worked solution

No supplied record matched the stated workshop comparison. That does not establish that no related event occurred. Verify the field mapping and fixture, then preserve uncertainty about missing sources, retention, and malformed records. Do not contact a real system to fill the gap without separate authorization.

2. Why is a synthetic actor id insufficient to identify a person?