Generated directly from final module app-data • 36 guided CLI work orders • module version 1.0.0. Syntax, command purpose, and context only. No solved challenges or case answer key.
Simulated terminal commands operate on fictional locally supplied sources. Run only within the authorized exercise. Actual Linux output may differ from the modeled engine. Instructor guidance is separate from terminal output.
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-01 Establish the case directory | pwd | Locate current virtual evidence workspace. |
| CLI-02 Read examiner assignment and restrictions | cat Incoming/EXAMINER_ASSIGNMENT_AND_SCOPE.txt | Confirm explicit module boundaries and source protection. |
| CLI-03 Read received scope summary | cat Incoming/authority_scope_and_consent_summary.txt | Compare received scope language with the training assignment. |
| CLI-04 Inventory the original intake directory | ls -lah Incoming | Identify all source files and modeled metadata. |
| CLI-05 Enumerate intake file paths | find Incoming -type f | Verify inventory independently of a single directory listing. |
| CLI-06 Verify modeled examiner identity | whoami | Record the current analyst account, not a suspect identity. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-07 Identify custody file format | file Incoming/intake_chain_of_custody.csv | Identify file format before processing. |
| CLI-08 Observe original intake file size | stat -c '%n %s bytes' Incoming/protected_witness_intake_Liora_Venn.txt | Read current length rather than guess from appearance. |
| CLI-09 Read witness intake record | cat Incoming/protected_witness_intake_Liora_Venn.txt | Establish witness-centered scope. |
| CLI-10 Read original intake custody entries | cat Incoming/intake_chain_of_custody.csv | Establish original claimed intake events and source clock. |
| CLI-11 Read witness status and declared role fields | cat Incoming/witness_status_record.json | Separate declared roles from inferred approval. |
| CLI-12 Review unsubmitted supplemental recall draft | cat Incoming/supplemental_recall_form_draft.txt | Keep personal draft notes separate from machine memory. |
| CLI-13 Identify the device-access restriction in JSON | grep -n -F 'medical-forensic scope required' Incoming/witness_status_record.json | Corroborate the file’s declared access restriction. |
| CLI-14 Read the projected received checksum excerpt | cat Incoming/RECEIVED_INTAKE_SHA256.txt | Examine hash claims and their scope. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-15 Verify only the five scoped received digests | sha256sum -c Incoming/RECEIVED_INTAKE_SHA256.txt | Independently verify each listed intake file. |
| CLI-20 Calculate SHA-256 for original and working intake | sha256sum Incoming/protected_witness_intake_Liora_Venn.txt Evidence/Working/protected_witness_intake_Liora_Venn.txt | Compare independently calculated file digests. |
| CLI-21 Compare original and working file bytes | cmp -s Incoming/protected_witness_intake_Liora_Venn.txt Evidence/Working/protected_witness_intake_Liora_Venn.txt | Confirm exact equality without relying solely on hashes. |
| CLI-22 Read the immediately preceding comparison status | echo $? | Associate the quiet comparison with its actual exit status. |
| CLI-23 Write a student-generated working-file checksum manifest | sha256sum Evidence/Working/protected_witness_intake_Liora_Venn.txt > Reports/SHA256SUMS.txt | Record a separate current digest baseline for one working file. |
| CLI-24 Check the working-file manifest entry | sha256sum -c Reports/SHA256SUMS.txt | Check the current file against the saved working baseline. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-16 Create separate working and reporting directories | mkdir -p Evidence/Working Reports | Protect Incoming from derivative writes. |
| CLI-17 Copy protected witness intake to working area | cp Incoming/protected_witness_intake_Liora_Venn.txt Evidence/Working/protected_witness_intake_Liora_Venn.txt | Preserve the original and work from copied bytes. |
| CLI-18 Copy intake custody CSV into working area | cp Incoming/intake_chain_of_custody.csv Evidence/Working/intake_chain_of_custody.csv | Prepare a second derivative without editing the source. |
| CLI-19 Copy scope summary for bounded review | cp Incoming/authority_scope_and_consent_summary.txt Evidence/Working/authority_scope_and_consent_summary.txt | Preserve scope text separately before any derived search. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-25 Locate the reported sidecar disclosure row | grep -n -F 'sidecar disclosure documented' Evidence/Working/intake_chain_of_custody.csv | Search the preserved working copy for one reported action. |
| CLI-26 Preserve a disclosure excerpt through tee | grep -n -F 'sidecar disclosure documented' Evidence/Working/intake_chain_of_custody.csv | tee Reports/intake_disclosure_excerpt.txt | Make a reproducible derivative while seeing the same stdout. |
| CLI-27 Reopen the saved disclosure excerpt | cat Reports/intake_disclosure_excerpt.txt | Verify the derivative actually exists and holds selected text. |
| CLI-28 Count the saved disclosure lines | wc -l Reports/intake_disclosure_excerpt.txt | Distinguish source rows from terminal echoes or actors. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-29 Diagnose a missing path without inventing evidence | cat Incoming/NOT_PRESENT.txt | Practice a realistic missing-file result. |
| CLI-30 Confirm Incoming rejects derivative writes | cp Incoming/authority_scope_and_consent_summary.txt Incoming/forbidden_copy.txt | Test read-only source protection without bypassing it. |
| CLI-31 Create a disposable report-area verification trial | cp Evidence/Working/protected_witness_intake_Liora_Venn.txt Reports/verification-trial.txt | Experiment only with a disposable derivative, never the evidence copy. |
| CLI-32 Baseline the disposable trial before mutation | sha256sum Reports/verification-trial.txt > Reports/TRIAL_SHA256SUMS.txt | Demonstrate why a stored digest is tied to a particular file state. |
| CLI-33 Deliberately alter only the disposable trial | echo CONTROLLED_TEST_CHANGE >> Reports/verification-trial.txt | Create an explicit modification to test the manifest checker. |
| CLI-34 Detect the now-stale trial digest | sha256sum -c Reports/TRIAL_SHA256SUMS.txt | Observe a legitimate integrity failure after changing bytes. |
| CLI-35 Restore the disposable trial from untouched working bytes | cp Evidence/Working/protected_witness_intake_Liora_Venn.txt Reports/verification-trial.txt | Practice authorized repair without rewriting the original. |
| CLI-36 Recheck and record successful trial verification | sha256sum -c Reports/TRIAL_SHA256SUMS.txt | Prove the restored file matches its initial trial baseline. |