Examination lab
Case studies
Every case here is invented for teaching: the organisations, people, numbers and hashes are synthetic. Each is written as an examiner's walkthrough — question, evidence, method, findings with a confidence level, and a plain statement of what the evidence cannot show. None narrates how a system was broken into; they show how the records left behind are read.
All cases are synthetic and for educational use.
VI-01Established
Files copied to a USB drive before a resignation
Computer and disk forensics
A departing employee is suspected of copying a project folder to a USB drive. Agreeing Windows artifacts show the device, the time and what was copied.
VI-02Probable
Recovering deleted messages from a chat database
Mobile device forensics
Messages were deleted from an Android app. The examination explains how some rows are recovered from the SQLite log and free pages, and why recovery is partial.
VI-03Probable
Reading the records behind a redirected-payment email
Email forensics
A supplier payment went to the wrong account after an emailed instruction. Headers, authentication results and audit logs show whether the sender was genuine.
VI-04Probable
Reconstructing a timeline after files were encrypted
Incident response and breach investigation
A server's files were found encrypted. The file-system journal and shadow copies give the order of file changes, and the logs are checked for clearing.
VI-05Probable
Assessing whether a photograph is an original
Image, video and document authentication
A photo is offered as taken on a certain date with a certain phone. EXIF, file structure and the embedded thumbnail are read to assess if it is untouched.
VI-06Established
Testing whether a document was backdated
Image, video and document authentication
A contract file carries a date earlier than the dispute. Internal metadata, Office structure and file-system times are compared to assess its creation date.
VI-07Possible
What call records can and cannot show about location
Communication records and CDR analysis
A party places a phone at a specific location from call records. The examination reads cell data as coverage areas, not points, and states what it supports.
VI-08Probable
Reading logon records to test an account-misuse claim
Incident response and breach investigation
An account reached a server outside working hours and the holder denies it. Logon and remote-session records show when, from where and how, and their limits.