Chapter 38 — Exercises

This is the integration chapter, so these exercises integrate. They run the twelve-phase lifecycle on the Meridian Health Analytics (MHA) matter and on fresh scenarios: concept checks on the arc as a whole, hands-on labs (extract a deleted file by inode, decode a FILETIME, detect a timestomp, build a finding, draft a cross-examination answer), and the judgment calls that decide whether a pile of artifacts becomes a defensible case file. The capstone group (G) directs you to assemble and grade the whole thing. (answer in Appendix) = worked solution in Answers. ⭐ = stretch. Where a lab references a practice image, see Appendix J — Practice Images and Lab Setup. Do every hands-on exercise only on images and data you are allowed to touch — public practice scenarios, disposable media you populated yourself, never real evidence. The habit of touching only what you are authorized to touch is the first thing this chapter grades.

Group A — The whole method: the lifecycle and integration

38.1 Reproduce the twelve-phase investigative lifecycle in order, from a single phrase each, and name the two disciplines that run underneath every phase without interruption. Then explain, in three or four sentences, why the chapter insists the value of the book "was never any single method but the integration of all of them," and what "the most common failure of new examiners is not technical incompetence — it is disorganization under the weight of a real case" means for how you should practice. (answer in Appendix)

38.2 Using the signature Recovery vs. Forensics lens: a 💾 data-recovery engagement typically runs which phases hard and largely stops there, and which phases does a 🔍 forensic engagement add? State, in one sentence each, why recovery usually skips the legal machinery and why forensics cannot. Then explain the chapter's warning, "you cannot retrofit a chain of custody — you can only have kept one," and what concretely it tells you to do on every recovery job. (answer in Appendix)

38.3 ⭐ The chapter says the analysis phases (4–9) "are not strictly sequential in practice; you will loop among them." Give a concrete, plausible example of an iteration loop on the MHA case in which a finding in the timeline (phase 8) sends you back to the registry (phase 5), and that registry result sends you back to carving (phase 4). Explain why the map's order is "the order of first pass" and why a beginner who treats it as a rigid one-way pipeline will miss evidence.

38.4 (Judgment.) A talented hobbyist can carve a JPEG, parse a registry hive, and build a timeline — yet the chapter claims a hobbyist's output and a professional's "are not equal in court." Beyond raw skill, name the four or five things the lifecycle supplies that an ad-hoc collection of techniques does not (think: scope, corroboration, negative findings, proportionality, documentation, review). For each, give the one-sentence consequence of leaving it out.

Group B — Phase 1–2: scope, ethics, acquire, verify

38.5 (Write the plan.) Write an excerpt of an investigation plan for a new civil matter — a departing finance manager suspected of taking a customer list to a competitor. State the one-sentence objective, then write three testable questions, each paired with its disconfirming check (the evidence that would show the activity did not occur). Explain why "an investigation plan that can only confirm the client's theory is not a plan; it is an advocacy brief," and which two later chapters' requirements such a one-sided plan would fail. (answer in Appendix)

38.6 (Concept — the two hashes.) Distinguish the container hash from the acquisition (bitstream) hash. For the MHA exhibit, the sidecar carried the container value b7e0c3f6…a1d4 and the E01 stored the acquisition values MD5 a3f5c91e… / SHA-256 9f2b6c8e…. State precisely what a match on each proves (transit integrity vs. data integrity), why they are different numbers doing different jobs, and why confusing the two on the stand is "a classic rookie error and a cross-examination gift." (answer in Appendix)

38.7 ⭐ (Calculate.) The MHA image reports source bytes: 512,110,190,592 (1,000,215,216 sectors × 512). (a) Verify the multiplication. (b) The annotated carve in the chapter sits at byte offset 8,589,934,592, described as cluster 2,097,152 × 4096. Verify that product, and express the offset as a power of two. (c) Explain in one sentence why being able to reproduce "sector × size = byte offset" by hand matters when a cross-examiner asks how you located a carved object.

38.8 (Write the procedure.) Draft the contraband contingency the chapter says belongs in your Authority & Ethics Memo before you ever open the image — even in a civil IP case. Use the chapter's six-verb skeleton (stop, do not copy, preserve in place, isolate, document only path/hash/time/method — never content — and escalate). Then explain in two or three sentences why writing it in advance "is what lets you execute it calmly instead of improvising at the worst possible time," and which chapter owns the full treatment.

38.9 (Judgment — authority and scope.) MHA's authority rests on corporate ownership, a signed acceptable-use policy, and a monitoring login banner — not a warrant. (a) Why does that civil, consent-based authority not extend to the custodian's personal cloud account or personal phone, and what is required to reach provider-held data? (b) Explain how the chain of custody and hashing you keep from phase 2 onward are exactly what let the evidence "cross that boundary intact" if the civil matter later refers a criminal aspect to law enforcement. (c) Name the cardinal cost of getting scope wrong (hint: it rhymes with "admissibility").

Group C — Phase 3–4: triage, encryption, file system, deleted files

38.10 (Triage judgment.) The capstone's live-box scenario: the subject machine is found powered on, logged in, encryption posture unknown, a network connection suspected. Using the order of volatility, write the triage sequence in order, and explain the single most important reason you do not simply pull the plug on a possibly-encrypted running machine (where does the decryption key live right now?). State which chapter makes this "life-or-death for the evidence." (answer in Appendix)

38.11 (Encryption assessment.) For each signature, name the encryption it indicates: 2D 46 56 45 2D 46 53 2D at offset 0; LUKS\xBA\xBE; the APFS encryption flag; and the conspicuous absence of any signature in a high-entropy region. For the BitLocker-protected MHA system volume, list the lawful key sources you would enumerate for a corporate device, name the one that is "the quiet, common win," and write the exact professional finding you would record if no lawful key existed.

38.12 (Hands-on — extract a deleted file.) Given this fls listing from the working image (the leading * marks deleted):

* 41902-128-3   patients_q3_2026.csv
* 41955-128-3   ingest_pipeline.py
* 42013-128-4   model_training.tar.gz

(a) Write the icat command that extracts inode 41902 to a recovered-files folder (the image is working/mha-laptop-WORK.dd, NTFS partition at offset 2048). (b) State the very next command you run on the extracted file and why. (c) Explain when MFT-remnant recovery is no longer possible and you must fall back to file carving, and what a carved file loses that an MFT-recovered file keeps. (answer in Appendix)

38.13 ⭐ (Hex — identify the carve.) A carve from unallocated space begins and ends like this:

00000000  FF D8 FF E1 00 18 45 78  69 66 00 00 49 49 2A 00  |......Exif..II*.|
...
0003F2FE  ... FF D9

(a) Identify the file type and what the header bytes FF D8 FF E1, the ASCII Exif, and the trailing FF D9 each prove. (b) Explain why a carved object "has no file name and no metadata," and what that costs you for attribution. (c) Name the one value you compute and record so the carved object can take its place on the exhibit hash list, and which appendix catalogs the signatures you matched.

38.14 (Concept — deleted ≠ destroyed, with its limit.) The MHA image yields both active copies of the dataset and deleted copies recovered from MFT remnants in unallocated space. Explain why the deleted copies are "a finding worth its limitation" — that is, why "the files had been deleted before imaging" is meaningful, but why it "does not by itself prove intent." Connect this to the book's foundational truth that deletion removes the pointer, not the data.

Group D — Phase 5–7: OS artifacts, browser/cloud, metadata

38.15 (Attribution chain.) Reconstruct the USB device history for the MHA case by chaining three registry locations into device-plus-user-plus-time attribution. For each location — SYSTEM\…\USBSTOR, SYSTEM\MountedDevices, and NTUSER.DAT (jokafor)\…\MountPoints2 — state which fact it supplies (the device, the drive letter, or which-user-and-when). Then write the one-sentence attribution conclusion the chain supports for the SanDisk Ultra (serial 4C530001120830117433, volume serial 1A2B-3C4D). (answer in Appendix)

38.16 ⭐ (Decode a FILETIME.) The MountPoints2 last-write time is stored on disk, little-endian, as 80 5E F4 7A E3 F9 DC 01. (a) Reverse the byte order to the 64-bit value and confirm it equals 134,256,844,330,000,000 ticks. (b) Convert to Unix time by subtracting 116,444,736,000,000,000 and dividing by 10,000,000, and confirm the result is 2026-06-11 20:47:13 UTC. (c) Explain in one sentence why a cross-examiner might ask whether your tool decoded this correctly, and why being able to do it by hand is your answer.

38.17 (Concept — execution vs. presence, access vs. authorship, account vs. person.) Three distinctions the report must preserve. (a) What does Prefetch prove that Amcache does not, and vice versa? (b) An LNK/Jump List entry shows the dataset was opened from volume serial 1A2B-3C4D — does that prove access, authorship, or both? (c) State the limitation that "every artifact in this phase ties activity to a user account, device, or session — never to a pair of hands," and write the careful sentence you would put in the report instead of "the custodian opened the file."

38.18 (Browser/cloud evidence and its limits.) (a) Explain the decisive difference between a TYPED navigation and a LINK (in-session) navigation, and why the TYPED login to the personal cloud on 2026-06-12 19:18 UTC is the stronger artifact. (b) SRUM (SRUDB.dat) shows chrome.exe sent ≈490 MB outbound in the upload window. State exactly what that proves and the three things it does not prove. (c) Where do you recover deleted browser history rows, and which theme does that recovery restate?

38.19 (Judgment — hash-set matching as an ethical instrument.) The same mechanism — hash-set matching and PhotoDNA — serves two very different cases. (a) For the MHA case, how does matching a recovered file's hash to a reference hash MHA provides let you "confirm a dataset's identity without trawling a stranger's medical records"? (b) For the courtroom anchor case, explain how hash-set identification lets an examiner do necessary work "without anyone viewing" content, and name its two beneficiaries. Keep your answer clinical, as the book requires.

Group E — Phase 8–9: super-timeline and anti-forensics

38.20 (Build the timeline.) (a) Describe the "Rosetta-stone problem" and the steps you take to solve it: where you read the evidence system's time zone, what you normalize everything to, and how you measure clock skew against an external reference. (b) Why does the chapter tell you to build the timeline twice — what does the fls/mactime bodyfile spine give you that the log2timeline/plaso super-timeline does not, and vice versa? (c) Describe the anchor → window → expand triage method, naming the strongest known event you would anchor on in the MHA case. (answer in Appendix)

38.21 ⭐ (Detect the timestomp.) For model_training.tar.gz, MFTECmd exports $STANDARD_INFORMATION Born: 2024-01-05 09:00:00.0000000`, `$FILE_NAME Born: 2026-06-11 21:05:47.3318442, and $UsnJrnl:$J FILE_CREATE 2026-06-11 21:05:47. (a) Which timestamp is the kernel truth and which is user-settable and therefore forgeable? (b) Name the two tells that mark the $SI value as forged. (c) State the true creation date and the two independent sources that establish it. (d) In one sentence, give the rule this exercise teaches about which clock you trust.

38.22 (Anti-forensics — the four fronts and the negative finding.) (a) Name the four fronts of the anti-forensics pass (wiping, timestomping, log tampering, hidden data) and, for each, one artifact or technique you check. (b) Explain how the CCleaner run "convicts itself" three ways (its own Prefetch entry, the registry key, and the dated holes it left). (c) Suppose no event 1102 (Security log cleared) appears — explain why that negative finding is something you report, not something you silently omit, and what its absence means for the logon record.

38.23 (Judgment — reasoning from absence carefully.) A conspicuous absence is ambiguous: a sparse Prefetch could mean a cleaner ran or that the machine was rarely used. For one such absence in a case, write both the anti-forensic hypothesis and the innocent alternative, and state what corroborating evidence would let you choose between them. Then summarize, in your own words, the lesson of the chapter's War Story (the examiner whose whole theory rested on one $SI "access" time that a backup agent had set), and the three habits it teaches.

Group F — Phase 10–12: correlate, report, testify

38.24 (Correlate — build the braid.) The claim "the proprietary dataset was copied to removable media on the evening of 2026-06-11" rests on a braid of independent mechanisms, not one artifact. (a) List the four independent sources that converge on it. (b) Explain why the independence of the strands is what makes the braid strong — "it is not plausible that four different subsystems coincidentally fabricated a consistent sequence." (c) State the two disconfirming checks (negative findings) that this correlation rules out, and why running them "discharges your duty to seek exculpatory as well as inculpatory evidence." (answer in Appendix)

38.25 (Proportionality — rewrite the overreach.) A draft report concludes: "Okafor stole the proprietary dataset and uploaded it to a competitor." Identify every way that sentence reaches past the evidence (intent, identity of the operator, a legal verdict). Then rewrite it as a proportionate conclusion the forensic evidence actually supports, in the chapter's "consistent with…" form, and explain why "correlation produces a story; proportionality keeps the story inside the fence the evidence builds."

38.26 ⭐ (Write the report — one finding.) Draft a single four-part finding (observation → supporting artifacts → interpretation → limitation) for the cloud-upload conclusion in the MHA case. Tie the observation to dated artifacts (TYPED navigation, SRUM bytes, recovered rows), keep the interpretation proportionate, and write a limitation that states honestly what SRUM's aggregate counters do and do not establish. Then explain why "filling every field forces fact and inference onto separate rungs."

38.27 (Testify — answer the cross.) The red-team is organized around seven classic cross-examination attacks: chain-of-custody gap, tool reliability, alternative explanation (Trojan/SODDI), examiner bias, overstatement, scope, and the timestamp wedge. Pick three, write the attacking question for each, and write the disciplined answer — and for each answer, name the thing already in the report it points back to (a negative finding, a validated tool version, a proportionate conclusion, a scope statement, the $SI`-vs-`$FN detection). Explain why "the case on the stand is mostly won beforehand."

38.28 (Report assembly.) Reproduce the report-assembly map: name at least six report sections and the phase that fills each. Then answer two design questions: (a) why is the executive summary written last, and what must it include even when it is unwelcome? (b) Why do you generate the exhibit hash list mechanically (hashdeep -c md5,sha256 -r exhibits/) rather than typing the hashes, and what failure mode does that prevent?

Group G — Progressive project: assemble and self-assess the case file

38.29 ⭐ (Progressive project — the capstone milestone.) This is the deliverable the whole book has been building toward: assemble the complete, court-admissible Forensic Case File for your matter, end to end, and grade it as an opposing expert would. Work a public end-to-end scenario image if you do not have your own (the Digital Corpora M57-Patents or Lone Wolf scenarios are ideal — see Appendix J). Produce all of the following and add them to the case-file folder:

1. Assemble the folder in the chapter's structure (00-admin/, 01-evidence/, 02-analysis/, 03-timeline/, 04-report/, 05-testimony/, exhibits/), confirming each item is present, hashed, and logged.
2. Verify integration, not just presence. Walk the chain backward from one conclusion to the raw bytes and confirm there are no broken links: every conclusion traces to findings; every finding cites an exhibit with a hash; every hash matches the exhibit hash list; every timeline entry names its source; every load-bearing finding is corroborated by ≥2 independent sources; every disconfirming check from your plan is reported.
3. Run the morning-of-trial re-verification: re-hash the working image against the acquisition value, record the result, the date, and the exact tool versions, and file it in 05-testimony/.
4. Score the self-assessment rubric (0 = absent, 1 = weak, 2 = defensible) across all fifteen criteria, and write a one-line plan to fix any row below 2. A professional case file scores 30/30.
5. Defend it (mock trial). With a partner, one plays opposing counsel and cross-examines on the finished file using the seven attacks and the rubric's weak rows; alone, set the file aside for a day and cross-examine it yourself in writing as the opposing expert trying to dismantle it.

Finish with a short reflection naming the single weakest point in your case and exactly how you would shore it up. Explain, in one sentence, why this integrated, self-assessed file "is the portfolio piece you show an employer" and "the proof that thirty-eight chapters became a skill."

Self-check. You have mastered this chapter when you can do four things without notes: run the twelve-phase lifecycle in order and explain what each phase produces for the next, keeping chain of custody and documentation unbroken underneath; take a single conclusion and correlate it backward to ≥2 independent mechanisms while naming the negative findings that rule out alternatives; state any conclusion proportionately — never confusing the jokafor account with a human operator, "consistent with" with "stole," or your role with the court's; and survive cross-examination by pointing every answer back to a discipline already in the report. If the container-vs-acquisition hash distinction, the $SI`-vs-`$FN timestomp test, or the difference between what/when and who/why still feels hazy, re-read the matching phase before you "rest," then move on to Chapter 39 — Certifications and Professional Development, which turns the case file you just built into a credential an employer and a court will recognize.