Generated directly from final module app-data • 42 guided CLI work orders • module version 1.0.0. Syntax, command purpose, and context only. No solved challenges or case answer key.
Simulated terminal commands operate on fictional locally supplied sources. Run only within the authorized exercise. Actual Linux output may differ from the modeled engine. Instructor guidance is separate from terminal output.
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-01 Identify the active scene case workspace | pwd | Resolve the current virtual working path. |
| CLI-02 Read the scene authority and patient-first rule | cat Incoming/EXAMINER_SCENE_ASSIGNMENT.txt | Read exact authority before accessing scene data. |
| CLI-03 List the scoped sources | ls -lah Incoming | Inventory the evidence files available in this module. |
| CLI-04 Enumerate the evidence paths | find Incoming -type f | Confirm paths before analysis. |
| CLI-05 Record the scene entry source digest | sha256sum Incoming/scene_entry_log.csv | Capture the source current SHA-256. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-06 Inspect door audit column names | csvcut -n Incoming/door_lock_audit.csv | Identify the structured column names and types. |
| CLI-07 Locate credential presentations | csvgrep -c Event_Type -m credential_presented Incoming/door_lock_audit.csv | Compare the initially rejected service token and later responder credential events. |
| CLI-08 Locate the administrative override | csvgrep -c Event_Type -m admin_override_request Incoming/door_lock_audit.csv | Find the accepted maintenance override and associated token. |
| CLI-09 Inspect concealed service-zone events | csvgrep -c Lock_Zone -m bedroom_closet_pass_through Incoming/door_lock_audit.csv | Find reported contacts for the hidden closet passage. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-10 Read native JSONL event types | jq -r '.event_type' Incoming/smart_home_events_student_v1.jsonl | Read each newline-delimited JSON object individually. |
| CLI-11 Time the management override in JSONL | jq -r 'select(.event_type=="admin_override_request") | .timestamp' Incoming/smart_home_events_student_v1.jsonl | Cross-check override timing against the door CSV. |
| CLI-12 Inspect maintenance-mode state | jq -r 'select(.event_type=="mode_entered") | .details.mode' Incoming/smart_home_events_student_v1.jsonl | Read the recorded maintenance state change. |
| CLI-13 Identify closet-panel contact ID | jq -r 'select(.event_type=="service_panel_contact") | .details.panel_id' Incoming/smart_home_events_student_v1.jsonl | Locate the concealed contact sensor. |
| CLI-14 Enumerate both closet passages | jq -r 'select(.event_type=="service_pass_through_state") | .timestamp' Incoming/smart_home_events_student_v1.jsonl | Observe two distinct service-open/close timestamps. |
| CLI-15 Read the manual scene-note state | jq -r 'select(.event_type=="manual_note_field_update") | .details.note_after' Incoming/smart_home_events_student_v1.jsonl | Identify the unit note added under maintenance session. |
| CLI-16 Assess selective personal comm failure | jq -r 'select(.event_type=="carrier_state_change") | .details.voice_status' Incoming/smart_home_events_student_v1.jsonl | Identify which device path had no service. |
| CLI-17 Cross-check apartment uplink state | jq -r '.apartment_gateway.wan_status' Incoming/unit_connectivity_scene_only_v1.json | Compare personal comm status with apartment WAN status. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-18 Find the wellness pretext requests | csvgrep -c Requestor_Label -m "Building Wellness Services" Incoming/visitor_access_requests_student_v1.csv | Examine the visitor request and later changed precheck wording. |
| CLI-19 Inspect pending visitor-state claims | csvgrep -c Decision_Status -m pending Incoming/visitor_access_requests_student_v1.csv | Check that initial visitor request did not carry explicit tenant approval. |
| CLI-20 Locate the maintenance banner in panel CSV | csvgrep -c Display_Text -m 'MAINTENANCE MODE ACTIVE' Incoming/wall_panel_events.csv | Corroborate amber maintenance banner. |
| CLI-21 Read apartment armed-state warnings | csvgrep -c Display_Text -m 'TAMPER RESPONSE: ARMED' Incoming/wall_panel_events.csv | Observe tamper ARMED at the apartment. |
| CLI-22 Classify the low-confidence route label | csvgrep -c Display_Text -m 'PARK ROUTE' Incoming/wall_panel_events.csv | Observe the Park phrase as a device-display claim only. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-23 Enumerate camera index fields | csvcut -n Incoming/hallway_camera_index_student_v1.csv | Understand what the camera index records and what it does not include. |
| CLI-24 Locate the maintenance-time image gap | csvgrep -c Availability -m gap Incoming/hallway_camera_index_student_v1.csv | Identify privacy-masked coverage rather than assume no movement occurred. |
| CLI-25 Inspect south-service camera index | csvgrep -c Camera_ID -m 32S Incoming/hallway_camera_index_student_v1.csv | Compare reported service-spine motion times with concealed panel contacts. |
| CLI-26 Locate pass-through in the static floor plan | grep -n -F 'Hidden Service' Incoming/floor_plan_unit_3214.svg | Use static SVG source text as an approximate location aid. |
| CLI-27 Read observed concealment details | cat Incoming/hidden_pass_through_observation_student_v1.txt | Review observed seam, dust break and scuffs without suggested conclusions. |
| CLI-28 Inventory scene marker labels | jq -r '.markers[].marker' Incoming/evidence_markers_student_v1.json | Link abstract marker IDs to scene artifacts. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-29 Review complete responder-entry context | csvcut -c Entry_ID,Timestamp,Person,Reason_for_Entry Incoming/scene_entry_log.csv | Read original responder/custody timeline claims. |
| CLI-30 Isolate emergency medical entries | csvgrep -c Agency_or_Group -m "Saint Meridian EMS" Incoming/scene_entry_log.csv | Distinguish necessary life-saving movement from possible deliberate scene staging. |
| CLI-31 Record Flores name from scene entry | csvgrep -c Person -m Flores Incoming/scene_entry_log.csv | Find the first-name reported by the scene entry log. |
| CLI-32 Record Flores name in lock audit | csvgrep -c Credential_Label -m Marek Incoming/door_lock_audit.csv | Find a second first-name associated with the guard record. |
| CLI-33 Record Flores name in recorder handling | csvgrep -c handler -m Tomas Incoming/recorder_handling_log.csv | Find a third conflicting responder name from handling source. |
| CLI-34 Inspect the text-only transcript claim | grep -n -F 'Tamper burn preferred.' Incoming/recorder_text_transcript_received.txt | Read a textual quotation as a claimed transcript only. |
| CLI-35 Sort conflicting custody collection times | csvsort -c collected_time Incoming/chain_of_custody_scene.csv | Compare reported collection/transfer claims against Kato technical entry time. |
| CLI-36 Review manifest-only photo entries | csvgrep -c Photographer -m "Jun Kato" Incoming/scene_photos_manifest_student_v1.csv | Record the photograph filenames and timestamps as an index. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-37 Create separate analysis destinations | mkdir -p Evidence/Working Reports | Preserve sources while creating reviewable derivatives. |
| CLI-38 Make an exact working audit copy | cp Incoming/door_lock_audit.csv Evidence/Working/door_lock_audit.csv | Create a source-preserving working copy. |
| CLI-39 Hash original and copy independently | sha256sum Incoming/door_lock_audit.csv Evidence/Working/door_lock_audit.csv | Measure both current byte digests. |
| CLI-40 Compare the actual byte streams | cmp -s Incoming/door_lock_audit.csv Evidence/Working/door_lock_audit.csv | Perform independent, quiet direct byte comparison. |
| CLI-41 Associate zero with the comparison | echo $? | Read the immediately preceding cmp result. |
| CLI-42 Save the source-backed override extract | csvgrep -c Event_Type -m admin_override_request Evidence/Working/door_lock_audit.csv | csvcut -c Timestamp,Audit_ID,Credential_ID,Result | tee Reports/override_extract.csv | Preserve a selected four-field source derivative. |