Generated directly from final module app-data • 42 guided CLI work orders • module version 1.0.0. Syntax, command purpose, and context only. No solved challenges or case answer key.
Simulated terminal commands operate on fictional locally supplied sources. Run only within the authorized exercise. Actual Linux output may differ from the modeled engine. Instructor guidance is separate from terminal output.
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-01 Identify case workspace | pwd | Record the case working directory. |
| CLI-02 Read authorized hospital scope | cat Incoming/EXAMINER_HOSPITAL_ASSIGNMENT.txt | Read scope, patient boundary and disallowed future sources. |
| CLI-03 Inventory released hospital artifacts | ls -l Incoming | Verify which permitted source filenames are present. |
| CLI-04 Examine the restricted consent | cat Incoming/limited_consent_form.txt | Identify the scope tied to the living witness. |
| CLI-05 Project allowed forensic categories | jq -r '.authorized_assessment.permitted_data_categories[]' Incoming/consent_scope_boundaries.json | Read permitted categories directly from policy JSON. |
| CLI-06 Inspect explicitly excluded categories | jq -r '.excluded_categories[]' Incoming/consent_scope_boundaries.json | Establish what may not be examined. |
| CLI-07 Read the no-vendor order | cat Incoming/no_vendor_access_order.txt | Confirm that third-party diagnostics and unsupported adapters were forbidden. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-08 Find the cradle calibration hold | csvgrep -c action -m calibration_hold_applied Incoming/cradle_transport_manifest.csv | Identify when the approved cradle entered a calibration hold. |
| CLI-09 Find the kit contents exception | csvgrep -c action -m contents_inventory_exception Incoming/cradle_transport_manifest.csv | Distinguish delivered outer hard case from missing cradle. |
| CLI-10 Read the delay card | cat Incoming/delayed_calibration_card.txt | Document the hold estimate as a claim. |
| CLI-11 Read the alternative-interface warning | cat Incoming/substitute_interface_warning.txt | Identify the prohibition on training-bridge substitution. |
| CLI-12 Find the passive wait warning | csvgrep -c primary_warning -m 'WAIT FOR AUTHORIZED CRADLE' Incoming/containment_monitor_passive_capture.csv | Observe pre-incident instructions from passive display. |
| CLI-13 Review partial Park-related display | csvgrep -c partial_identifier_2 -m FORMALIZATION Incoming/containment_monitor_passive_capture.csv | Locate a partial low-confidence display label before loss. |
| CLI-14 Examine trainee access restriction | csvgrep -c person_name -m "Nico Raines" Incoming/diagnostic_suite_access_log.csv | Identify Nico’s authorized role as observation only. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-15 Inventory workstation event fields | csvcut -n Incoming/observation_workstation_eventlog_student.csv | Read actual eventlog columns before filtering. |
| CLI-16 Locate restriction acknowledgment | csvgrep -c event_id -m 8004 Incoming/observation_workstation_eventlog_student.csv | Observe a local observer-policy banner acceptance. |
| CLI-17 Find USB insertion evidence | csvgrep -c event_id -m 410 Incoming/observation_workstation_eventlog_student.csv | Locate plug-in timestamp and hardware IDs. |
| CLI-18 Find unsupported hardware warning | csvgrep -c message -m 'TRAINING / NON-FORENSIC / UNSUPPORTED' Incoming/observation_workstation_eventlog_student.csv | Document the workstation-level warning before service access. |
| CLI-19 Find service-port access record | csvgrep -c message -m 'Workstation service port accessed' Incoming/observation_workstation_eventlog_student.csv | Identify a service action separate from USB insertion. |
| CLI-20 Find bridge handshake record | csvgrep -c message -m 'Service bridge handshake request generated' Incoming/observation_workstation_eventlog_student.csv | Identify the request which crossed the observation boundary. |
| CLI-21 Identify legacy adapter in USB history | csvgrep -c serial_number -m NIFB-LG-4C77 Incoming/usb_device_history.csv | Correlate serial and port across sources. |
| CLI-22 Read the hardware warning label | cat Incoming/nif_bridge_adapter_label.txt | Review physical training/non-forensic warning and asset identification. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-23 Read pre-connection isolation state | jq -r '.before_unauthorized_connection.isolation_state' Incoming/service_port_status_student.json | Measure the reported starting isolation state. |
| CLI-24 Read active handshake label | jq -r '.during_unauthorized_connection.handshake_type_claimed_by_tool' Incoming/service_port_status_student.json | Compare requested preview label with observed active handshake. |
| CLI-25 Inspect post-connection locked port | jq -r '.after_unauthorized_connection.service_port_2_state' Incoming/service_port_status_student.json | Identify the recorded supervised lockdown after the event. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-26 Project the chronological purge states | csvcut -c sequence,timestamp,event_state Incoming/purge_sequence_student.csv | Reconstruct the visible sequence from service-port access to minimal recovery state. |
| CLI-27 Isolate UAL-7 entries | csvgrep -c rule_id -m UAL-7 Incoming/purge_sequence_student.csv | Locate the retained unauthorized-access rule ID. |
| CLI-28 Check which areas were declared cleared | csvgrep -c event_state -m CLEARED Incoming/purge_sequence_student.csv | Identify destroyed cache, buffer and index-table states. |
| CLI-29 Identify the SQLite case database | file Incoming/sidecar_tamper_log_student.sqlite | Verify that the evidence source is a SQLite database before queries. |
| CLI-30 Enumerate SQLite tables | sqlite3 -readonly Incoming/sidecar_tamper_log_student.sqlite .tables | Inspect available tables without changing the source. |
| CLI-31 Read initial tamper-log sequence | sqlite3 -readonly -header -column Incoming/sidecar_tamper_log_student.sqlite "SELECT event_id,sequence,state FROM tamper_events ORDER BY sequence LIMIT 5;" | Locate first five recorded tamper events. |
| CLI-32 Correlate UAL-7 in the database | sqlite3 -readonly -header -column Incoming/sidecar_tamper_log_student.sqlite "SELECT event_id,rule_id,state FROM tamper_events WHERE rule_id='UAL-7' ORDER BY sequence;" | Trace database rows labeled with UAL-7. |
| CLI-33 Examine cleared-region rows | sqlite3 -readonly -header -column Incoming/sidecar_tamper_log_student.sqlite "SELECT region_name,state,readable_content FROM cleared_regions ORDER BY region_id;" | Show three recorded lost regions and 0 readable-content fields. |
| CLI-34 Identify surviving metadata markers | sqlite3 -readonly -header -column Incoming/sidecar_tamper_log_student.sqlite "SELECT marker_type,marker_value FROM surviving_markers ORDER BY marker_id;" | List the UAL-7, bridge, receipt-marker and local-log remnants. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-35 Inspect reported hospital arrival time | cat Incoming/medical_stabilization_note.txt | Compare arrival claim against Module 03 EMS-entry claims. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-36 Create authorized working and report folders | mkdir -p Evidence/Working Reports | Separate immutable originals from writable review artifacts. |
| CLI-37 Copy the purge ledger into the working set | cp Incoming/purge_sequence_student.csv Evidence/Working/purge_sequence_student.csv | Preserve a derivative of the received purge timeline. |
| CLI-38 Hash source and working purge ledgers | sha256sum Incoming/purge_sequence_student.csv Evidence/Working/purge_sequence_student.csv | Independently observe digests of both current file paths. |
| CLI-39 Compare source and working ledger bytes | cmp -s Incoming/purge_sequence_student.csv Evidence/Working/purge_sequence_student.csv | Perform a quiet byte comparison. |
| CLI-40 Read the immediate compare status | echo $? | Tie the observed zero to the actual preceding cmp. |
| CLI-41 Preserve a bounded UAL-7 working extract | csvgrep -c rule_id -m UAL-7 Evidence/Working/purge_sequence_student.csv | tee Reports/ual7_trigger_extract.csv | Save the observed rule-labeled entries as an actual derived CSV. |
| CLI-42 Reopen the preserved UAL-7 extract | cat Reports/ual7_trigger_extract.csv | Verify the derived file exists and contains current source-backed rows. |