Forensics · Lesson 01
Forensics Competition Workflow
Learn how to turn a forensic prompt into a focused evidence search, preserve useful context, corroborate important facts, and produce a concise answer that says no more than the evidence can support.
The goal is not to inspect everything. The goal is to find the right evidence for the exact question and explain why it answers that question.
Lesson Snapshot
Learning objectives
Answer the question from evidence, not intuition
Turn a forensic question into a focused evidence plan before searching the system.
Distinguish direct observation, reasonable inference, and unsupported speculation.
Choose the most relevant artifact source for users, files, times, processes, services, network activity, and browser evidence.
Preserve context such as paths, timestamps, account names, hashes, event IDs, and neighboring records.
Corroborate important conclusions with a second source when the evidence allows it.
Write concise competition answers that include exactly the fact requested and the evidence supporting it.
Core idea
Every forensic question should become an evidence plan
Before searching, decide what fact must be proven and which artifact is most likely to contain it. This keeps the investigation focused and reduces unsupported conclusions.
Safety boundary
Preserve evidence before hardening
If a forensic question concerns a suspicious file, process, account, service, task, or connection, record the evidence before deleting, stopping, disabling, or renaming it.
Question types
Identify what the prompt is really asking for
Who?
Which user account, administrator, process owner, sender, recipient, or logged-in identity is relevant?
Likely sources
Authentication logs, account databases, file ownership, process ownership, browser profiles, email metadata.
What?
Which file, process, service, event, command, configuration, or artifact is being asked about?
Likely sources
Filesystem, hashes, process lists, services, logs, startup locations, application records.
When?
What time did an event, login, file change, download, startup, or connection occur?
Likely sources
File timestamps, event logs, journal entries, browser history, scheduler history, network logs.
Where?
Which path, host, interface, directory, profile, network address, or storage location is involved?
Likely sources
Filesystem paths, hostnames, log source fields, IP addresses, browser downloads, configuration files.
How?
Which process, service, scheduled task, account action, browser event, or network connection explains the activity?
Likely sources
Process evidence, service logs, task scheduler, cron, authentication, browser artifacts, connection records.
Sequence?
What happened first, next, and last across multiple artifacts?
Likely sources
Cross-source timeline combining logs, files, accounts, processes, browser, and network evidence.
Competition workflow
Move from prompt to defensible answer
Read the question exactly
Underline the noun and verb. Decide whether the prompt asks for a file, user, time, path, process, service, address, event, or sequence.
Output
A one-sentence restatement of the fact you need to prove.
Identify the best primary artifact
Choose the evidence source most directly connected to the question rather than opening every available file and log.
Output
One primary evidence source and one optional secondary source.
Collect surrounding context
Record path, timestamp, user, host, event ID, process, hash, port, or nearby records that explain what the artifact means.
Output
A short evidence note, not just a copied value.
Corroborate
Look for another independent artifact that supports or challenges the same conclusion.
Output
A second clue, or a note that corroborating evidence was not available.
Check competing explanations
Ask whether the evidence could reasonably mean something else, especially when using filenames, timestamps, browser records, or account names.
Output
A clear confidence boundary.
Answer only the question
Provide the requested fact and the evidence that supports it. Avoid adding a larger story unless the prompt asks for one.
Output
A concise, evidence-backed competition answer.
Evidence hierarchy
Know how strong your conclusion really is
Direct evidence
The artifact directly contains the requested fact.
Example
A log entry records the username and exact login time.
Corroborating evidence
A separate artifact independently supports the same conclusion.
Example
A browser download time aligns with a file creation time.
Contextual evidence
The artifact helps explain the environment but does not prove the answer by itself.
Example
The system hostname and active user profile establish where the evidence came from.
Inference
A conclusion is reasonable but is not stated directly in any one artifact.
Example
A process likely opened a file because the timestamps and application history align.
Speculation
The claim goes beyond what the evidence can support.
Example
Assuming a person intentionally performed an action merely because a file exists in their profile.
Question-to-source map
Start with the artifact most likely to answer directly
Which account logged in?
Primary
Authentication logs or event records
Corroborate with
User profile activity, process ownership, recent file activity
Which file was downloaded?
Primary
Browser download history
Corroborate with
Filesystem metadata and hash
When was a service changed?
Primary
Service or system event logs
Corroborate with
Configuration timestamps, administrative logs
Which process was listening on a port?
Primary
Process and network connection evidence
Corroborate with
Service configuration and logs
What started automatically?
Primary
Startup entries, scheduled tasks, cron, service configuration
Corroborate with
Process history or logs
What happened first?
Primary
Timeline built from the most reliable timestamps available
Corroborate with
Independent source with matching time and event context
Windows evidence
Common places to look
Event Viewer
System, Security, Application, and specialized channels where supported.
User Profiles
Desktop, Downloads, Documents, AppData, browser data, recent activity.
Services & Startup
Services, Task Scheduler, startup folders, configuration references.
Filesystem Metadata
Names, paths, sizes, timestamps, ownership, permissions, hashes.
Network State
Listeners, active connections, local and remote addresses, process ownership.
Application Artifacts
Browser records, application logs, document metadata, email metadata.
Linux evidence
Common places to look
Authentication Logs
Login, sudo, SSH, and account activity depending on distribution and logging setup.
Journal
Systemd journal records for services, boots, authentication, and system events.
User Home Directories
Documents, downloads, shell history, application configuration, user-owned files.
Services & Startup
systemd units, enabled services, cron jobs, shell startup files.
Filesystem Metadata
Paths, permissions, ownership, timestamps, hidden files, hashes.
Network State
Listeners, connections, interface state, DNS configuration, process ownership.
Context fields
Never copy one value without recording what gives it meaning
Path
The same filename in Downloads, System32, /tmp, or /usr/bin has very different context.
Timestamp type
Creation, modification, access, event, and log timestamps can describe different actions.
Time zone
Cross-source timelines can be wrong if artifacts use different zones or formats.
User
Ownership, login identity, and process owner may be different concepts.
Host
Evidence from multiple machines must not be mixed without noting source system.
Hash
A hash identifies exact file content more reliably than a filename alone.
Event ID or record ID
Structured logs often need identifiers to explain what type of event occurred.
Neighboring records
Events before and after the target record often explain cause, sequence, or scope.
Timeline discipline
Time is powerful evidence, but only when interpreted carefully
Normalize time carefully
Record the original timestamp and its zone or format before converting anything.
Do not overread file times
File creation or modification times can be changed by copying, extraction, restoration, or application behavior.
Logs may roll over
Absence of an older event does not prove the event never occurred.
Clock drift can exist
Different systems can disagree slightly if time synchronization is imperfect.
Sequence matters more than one timestamp
Several agreeing events are stronger than one isolated timestamp.
Record uncertainty
If two sources conflict, document the difference instead of silently choosing one.
Evidence preservation
Do not destroy the artifact you still need to understand
Do not delete the suspicious file
Its path, hash, metadata, or contents may be needed for later questions.
Do not clear logs
Authentication, service, system, and application events can be the only record of an action.
Do not restart services casually
A restart can change timestamps, process IDs, memory state, and log context.
Do not rename evidence casually
The original path and filename may be part of the answer.
Do not execute unknown content
Investigation should not create new activity or expose the lab system unnecessarily.
Do not overwrite original notes
Keep observations, interpretation, and later corrections distinguishable.
Evidence notes
Write notes another teammate could follow
Question
Which user downloaded archive.zip?
Primary artifact
Browser download history for the relevant profile.
Observed fact
archive.zip appears in the download record at 14:08.
Context
Record belongs to profile student1 and points to Downloads\archive.zip.
Corroboration
Filesystem creation time is near 14:08 and the file hash matches the evidence set.
Answer
student1, supported by the browser record and matching file evidence.
Confidence
Say how strong the evidence actually is
High confidence
The requested fact appears directly in a reliable artifact and is supported by another source.
Moderate confidence
The primary artifact supports the conclusion but corroboration is limited or indirect.
Low confidence
The conclusion depends heavily on inference, ambiguous metadata, or incomplete logs.
Insufficient evidence
The available artifacts do not support a responsible answer yet.
Competition mistakes
Habits that produce weak forensic answers
Searching everything before reading the question
Wastes time and increases the chance of being distracted by irrelevant artifacts.
Treating a filename as proof
Names can be changed, misleading, duplicated, or unrelated to actual content.
Assuming the owner performed the action
File ownership and user intent are not the same thing.
Ignoring neighboring log events
The target event may make sense only when viewed with the entries before and after it.
Copying a timestamp without its time zone
Cross-source timeline order can become incorrect.
Deleting or fixing evidence too early
A later forensic question may depend on the artifact you changed.
Writing a long story instead of the requested fact
Extra unsupported claims make an otherwise correct answer weaker.
Confusing correlation with causation
Two events occurring near each other does not automatically prove one caused the other.
Evidence-based reasoning
Separate what you observed from what you think happened
A suspicious archive exists in a user's Downloads folder
Weak conclusion
The user definitely downloaded and intentionally used the archive.
Better conclusion
The file exists in that profile. Check browser download records, file metadata, hash, and nearby user activity before making a stronger conclusion.
A process name looks unfamiliar
Weak conclusion
Mark it malicious immediately.
Better conclusion
Record the process name, path, owner, parent, start time, hash where available, and related service or startup evidence.
A login event appears at 09:14
Weak conclusion
Assume the account owner was physically at the keyboard.
Better conclusion
The event shows authentication activity for that account. Additional evidence would be needed to claim who physically initiated it.
A file modification time matches a browser download time
Weak conclusion
The browser definitely modified the file.
Better conclusion
The timestamps align and support a possible relationship, but corroborate with path, browser record, and file creation context.
A network connection uses an unusual remote port
Weak conclusion
The traffic is malicious because the port is uncommon.
Better conclusion
Record the process, remote address, protocol, port, timestamp, and whether the connection matches an expected service.
An administrator account was created recently
Weak conclusion
Delete it immediately before answering the forensic question.
Better conclusion
Preserve the account evidence, identify who or what created it, record timing and privilege, answer the forensic question, then harden separately if required.
Practice prompts
Choose the best first evidence source
Which user downloaded the file research-notes.zip?
Start here
Browser download history for each user profile.
Corroborate
File path, ownership, creation time, and hash.
At what time did the service stop?
Start here
Service or system event log.
Corroborate
Application log or adjacent service events.
Which process was listening on TCP port 8080?
Start here
Network listener and process mapping.
Corroborate
Service configuration, process path, or startup evidence.
Which account performed an administrative action?
Start here
Authentication and administrative logs.
Corroborate
Process owner, command history, or related system event where available.
Which event happened first?
Start here
Normalize timestamps from the directly relevant artifacts.
Corroborate
Independent logs or file metadata that confirm sequence.
Was the downloaded file later opened?
Start here
Application or recent-file evidence if available.
Corroborate
Process timeline, document history, or related logs.
Fictional case lab
Build a conclusion from several independent artifacts
Authentication log
User trainee1 begins an interactive session on CP-WS-07.
Browser download record
archive.zip is recorded as a download into the trainee1 Downloads folder.
Filesystem metadata
archive.zip appears in the Downloads directory with a matching creation time.
Application history
An archive utility starts under trainee1.
Filesystem metadata
notes.txt appears in a new extracted folder.
Network connection record
A process owned by trainee1 opens a connection to a fictional lab server.
Which account was active before the download?
trainee1, based on the authentication record at 14:05.
What artifact most directly shows the file was downloaded?
The browser download record at 14:08.
What supports the browser record?
Filesystem metadata shows archive.zip appearing in the same profile at approximately the same time.
Can we prove why trainee1 downloaded the archive?
No. The evidence supports activity and sequence, not motive.
What additional evidence would strengthen the claim that the archive was opened?
Application history, recent-file evidence, process records, or extraction-related filesystem changes.
What should be preserved before any cleanup?
The archive, metadata, relevant logs, browser record, extracted files, process evidence, and network record.
Lesson checklist
Before moving on
I restate the forensic question before searching.
I choose a primary artifact instead of opening everything.
I record path, time, user, host, and other relevant context.
I distinguish observation from inference.
I look for a second source when the conclusion matters.
I preserve evidence before changing or deleting anything.
I do not execute unknown content simply to investigate it.
I account for timestamp type and time zone.
I avoid treating filename, ownership, or location as proof of intent.
I keep my answer scoped to exactly what the question asks.
I state when evidence is incomplete or ambiguous.
I keep a short evidence note that another teammate could follow.
Reflection
Check your reasoning
Question 1
Why is reading the forensic question carefully more important than opening every available log?
Question 2
What is the difference between direct evidence and corroborating evidence?
Question 3
Why can a file in a user's profile fail to prove that the user intentionally created or used it?
Question 4
Why should timestamps be recorded with their type and time zone?
Question 5
What evidence would you preserve before changing a suspicious service or scheduled task?
Question 6
When should you answer that the evidence is insufficient instead of guessing?
Carry this forward
Read the exact question, select the most relevant artifact, preserve context, corroborate important facts, record uncertainty, and answer only what the evidence supports.