Examination lab
Case packs
A case study shows how an examiner read the evidence. A case pack hands you the evidence: a set of files to download, verify and examine yourself, with questions that lead from integrity and time base to a finding you could sign, and a separate page for instructors.
All pack files are synthetic and for training only.
How a pack works
Download and verify
Download the files and check every SHA-256 against the pack's manifest before you open anything.
Examine
Answer the questions from the files alone, noting the file and row behind each answer. Answers are checked in your browser.
Write the finding
Close with one paragraph that a reviewer could sign: times in UTC, accounts not people, each claim tied to a record, limits stated.
Debrief
In a class, the instructor page gives the plan, the key, the timeline and the points to close on.
Instructors: VP-01 instructor notes. These pages contain the answers.