PROBLEM
Analysis starts with a tool and ends with a file that has no source and no time.
PODEJŚCIE
Repeatable lab intake: where the material came from, which copy, which observations.
ARCHITECTURE
- analysis workstation
- practice material (own images / logs)
IMPLEMENTATION
- observation worksheet
- a few Windows / Linux artefacts
- fact / hypothesis split
RESULT
- forensics worksheet as a resource
- intake procedure in notes
- no “cases won in court”
LESSONS
- a hypothesis written as fact ruins the report
Goal
Forensics in this portfolio is procedure training: intake, copy, observation. It is not a list of criminal cases and not a court-expert certificate.
Two problems I solved
1. Tool before chain of custody
I opened an image in a tool before recording where it came from, who handed it over, and whether I was on a copy. A week later the path could not be defended.
What I gained: a rigid intake: provenance, hash/copy, time zone, no work on the original. The observation worksheet forces those fields before conclusions appear.
2. Hypotheses written as facts
Notes mixed “I saw it in Prefetch” with “so the user definitely…”. The report lost credibility.
What I gained: a fact / hypothesis / unknown split. Conclusions have limits; a guess does not become a fact without a second source.
What I practise
- own material (test images, lab logs) — never “the only copy”,
- a narrow Windows/Linux artefact timeline,
- separating observation from interpretation,
- hand-off: what can be stated, what cannot.
Related material
Boundaries
No court testimony, no work on the only copy of someone else’s evidence, no promise to recover everything.
Status
research: exercise set and worksheet are under construction. I do not publish screenshots from private disks.