Create Next App

Lesson Progress

Digital Forensics Basics Lab

High School Intermediate • I12: Digital Forensics Basics • Lesson 8 of 8

100% complete

Readiness Check

Integrated Lab Readiness

0/5 ready

Lab Mission

Investigate the Northbridge Duplicate Archive Folder

A fictional archive owner reports that approved export job 441 created the expected folder and an unexpected approved-copy folder. The supplied evidence includes metadata, process, identity, application, storage, cloud, network, deployment, support, and source-health records. One application source was delayed. One unrelated folder reference is outside scope. Your task is to build a complete, reviewable case package without overstating any artifact or crossing the authorization boundary.

Required safety boundary

Every organization, identity, file, path, process, log, route, record, timestamp, owner, decision, and conclusion in this lab is fictional. Do not substitute real evidence.

Professional standard

Every final claim must trace to approved evidence and preserve source health, alternatives, confidence, limitations, scope, impact boundary, review, and owner decision.

Case Brief

Authorization, Scope, Privacy, and Required Outcome

Organization

Northbridge Research Archive

A fictional research-storage and export service used only for this defensive training lab.

Case identifier

NRA-DF-2026-012

The fictional case identifier used across evidence, findings, reports, exhibits, and communications.

Primary question

Did the approved archive-export workflow create the unexpected duplicate folder during job 441?

The case must answer the mechanism, scope, supported impact, confidence, limitations, and owner action.

Decision owner

Fictional Incident Lead

Responsible for approving the case scope, corrective action, communication, and closure.

Approved evidence

Metadata, process, identity, application, storage, cloud, network, deployment, support, and source-health records

Only the supplied fictional evidence on this page may be used.

Privacy boundary

Metadata-first; no unrelated-folder or file-content review

The approved question can be answered without opening fictional file contents.

Stop conditions

Out-of-scope evidence, unclear ownership, unsafe collection method, missing authorization, or real-system access

Any stop condition requires preservation, documentation, owner review, and an explicit restart decision.

Required outcome

Complete fictional forensic case package

The package must be reproducible, reviewable, privacy-aware, versioned, and portfolio-safe.

Supplied Evidence

Northbridge Fictional Evidence Set

NRA-E-001

Support report

Approved

Source

Fictional archive owner

Direct record

The approved export completed, but an unexpected approved-copy folder appeared several minutes later.

Case relevance

Defines the original observation and business question.

Limitation

Human report does not prove the technical mechanism.

NRA-E-002

File-metadata export

Approved

Source

Fictional archive platform

Direct record

The approved and approved-copy folders each contain five files with matching content hashes and preserved modification values.

Case relevance

Supports duplicate content and later path creation.

Limitation

Copy behavior may reset creation values.

NRA-E-003

Process snapshot

Approved

Source

Fictional endpoint custodian

Direct record

The scheduler launched archive-export-worker, which launched copy-worker with target approved-copy and configuration export-legacy.

Case relevance

Provides the strongest runtime mechanism for duplicate creation.

Limitation

Represents one moment rather than the full process history.

NRA-E-004

Identity records

Approved

Source

Fictional identity platform

Direct record

The approved archive-export service identity opened session SVC-22 before job 441 started.

Case relevance

Connects the approved workflow to the event window.

Limitation

Service identity does not prove human intent.

NRA-E-005

Application audit

Approved with delay

Source

Fictional archive application

Direct record

The application records the copy operation for job 441, but the event arrived twelve minutes after its source event time.

Case relevance

Confirms the same workflow after source repair.

Limitation

Receipt time must not replace event time.

NRA-E-006

Storage transaction

Approved

Source

Fictional archive-storage service

Direct record

Five duplicate-file writes completed under job 441 using the approved service route.

Case relevance

Corroborates file metadata and process target.

Limitation

Storage events do not prove intent.

NRA-E-007

Cloud audit

Approved

Source

Fictional cloud platform

Direct record

No public-link, external-share, unrelated-account download, or permission-expansion event appears in verified coverage.

Case relevance

Narrows supported impact.

Limitation

Negative conclusion remains bounded by coverage, retention, account, platform, and time window.

NRA-E-008

Network flow

Approved

Source

Fictional network service

Direct record

The copy-worker communicated only with archive-storage-api.internal during the observed operation.

Case relevance

Supports an internal-only service route.

Limitation

Flow does not reveal full payload content.

NRA-E-009

Deployment record

Approved

Source

Fictional release platform

Direct record

The runtime used the outdated export-legacy configuration; the approved replacement was deployed after review.

Case relevance

Supports the root condition and corrective action.

Limitation

Repository state requires runtime correlation.

NRA-E-010

Source-health record

Approved

Source

Fictional monitoring service

Direct record

Application delivery lagged by twelve minutes while file, identity, process, storage, cloud, and network sources remained current.

Case relevance

Explains the apparent timeline conflict.

Limitation

Earlier timeline confidence must remain visible.

NRA-E-011

Recent-item and preview records

Approved

Source

Fictional archive-review application

Direct record

The approved folder was referenced by the review application and generated preview entries.

Case relevance

Supports application reference to the approved path.

Limitation

Does not prove that a human fully opened or read every file.

NRA-E-012

Unrelated-folder reference

Reference only

Source

Fictional metadata package

Direct record

The export package contains a reference to an unrelated research folder outside current authorization.

Case relevance

Creates a scope and privacy stop condition.

Limitation

No content review or conclusion is permitted.

Collection Plan

Prioritize, Preserve, Substitute, or Stop

Priority 1

Process snapshot

Reason

Highest volatility and direct relevance to the active workflow.

Approved method

Preserve the supplied fictional snapshot and verify integrity.

Alternate evidence

Application job, deployment, storage, and identity records.

Stop condition

Do not collect from any real process or system.

Priority 2

File-metadata export

Reason

Directly records duplicate paths, hashes, timestamps, and ownership.

Approved method

Preserve the supplied export and create a verified working copy.

Alternate evidence

Storage transactions, backup catalog, and cloud object history.

Stop condition

Do not open fictional file contents.

Priority 3

Identity and session records

Reason

Connect the approved service identity to job 441.

Approved method

Use the supplied fictional export with source-health documentation.

Alternate evidence

Application request, process ownership, and storage transactions.

Stop condition

Do not infer human identity or intent.

Priority 4

Cloud and network records

Reason

Test external sharing, download, destination, and route hypotheses.

Approved method

Use the supplied fictional cloud and flow exports.

Alternate evidence

Application, support, identity, and vendor records.

Stop condition

Do not capture or query any real network or cloud service.

Priority 5

Delayed application audit

Reason

Confirms the job and copy operation after source repair.

Approved method

Preserve event and receipt times and validate completeness.

Alternate evidence

Process, storage, file, and identity records.

Stop condition

Do not order events by arrival time.

Priority 6

Deployment and configuration

Reason

Tests whether export-legacy was active during the event.

Approved method

Compare supplied repository, rollout, startup, and runtime records.

Alternate evidence

Process arguments and application startup records.

Stop condition

Do not assume repository state equals runtime state.

Priority 7

Support and business records

Reason

Preserve the original observation, expected workflow, and owner decision.

Approved method

Use the supplied fictional report and approval records.

Alternate evidence

Application and storage records.

Stop condition

Do not treat the human report as technical proof.

Priority Do not collect

Unrelated research-folder content

Reason

Outside scope and unnecessary for the approved case question.

Approved method

Preserve only the existing reference.

Alternate evidence

None required.

Stop condition

Pause and request new approval before any review.

Fake Dashboard

Fake Northbridge Integrated Forensics Dashboard

Training dashboard for supplied fictional evidence only.

Approved evidence sources

11

Eleven fictional sources are approved for review; one unrelated-folder reference remains out of scope.

Supported findings

6

Every fictional finding includes evidence, alternatives, confidence, limitation, impact boundary, and decision effect.

Open analytical limits

3

Exact human awareness, full historical process state, and events outside verified coverage remain unsupported.

Fake SOC Alert

Integrated Case Review Requires a Scope Decision

Source: Fake Northbridge Forensics Console • Time: 10:24 AM

High Severity

The fictional metadata package references an unrelated research folder while the approved case question is already answerable from metadata, process, identity, application, storage, cloud, network, deployment, support, and source-health evidence.

Defensive recommendation: Do not inspect the unrelated folder. Preserve the reference and context, restrict exposure, record the stop condition, notify the fictional incident and privacy owners, continue only within approved scope, and request expansion only if a new documented case question makes the source necessary.

Fake Log Panel

Fake Northbridge Integrated Case Records

training-log-viewer.log

09:00 CASE id='NRA-DF-2026-012' question='duplicate folder mechanism'
09:06 RECEIVE evidence='NRA-E-002' type='metadata export'
09:11 COPY evidence='NRA-E-002-WORK-01' verification='pass'
09:14 ID session='SVC-22' identity='archive-export-service'
09:15 PROCESS worker='archive-export-worker' config='export-legacy'
09:16 PROCESS child='copy-worker' target='approved-copy'
09:16 FLOW destination='archive-storage-api.internal'
09:17 FILE duplicate_paths='begin' hashes='matching'
09:17 STORAGE writes='5' job='441'
09:20 APP event='copy complete' receipt='09:32'
09:38 HEALTH application_delay='12m' repair='assigned'
09:48 DERIVE artifact_table='NRA-D-006' parent='NRA-E-002-WORK-01'
10:02 RECEIVE application='validated complete'
10:18 TIMELINE version='v2' prior='preserved'
10:24 SCOPE unrelated_folder='reference only'
10:45 REVIEW integrity='pass' custody='complete' lineage='complete'
11:05 FINDING mechanism='approved worker with outdated config'
11:20 IMPACT external_disclosure='not supported within coverage'
12:15 ACTION config='replaced' validation='approved'
15:30 VALIDATE corrected_workflow='pass' recurrence='none observed'

Training note: this is fake data for defensive analysis practice only.

Chain of Custody