Generated directly from final module app-data • 50 guided CLI work orders • module version 1.1.0. Syntax, command purpose, and context only. No solved challenges or case answer key.
Simulated terminal commands operate on fictional locally supplied sources. Run only within the authorized exercise. Actual Linux output may differ from the modeled engine. Instructor guidance is separate from terminal output.
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-01 Identify the investigation workspace | pwd | Observe the absolute modeled case root. |
| CLI-02 Read the permitted provider/municipal scope | cat Incoming/EXAMINER_PROVIDER_BROKER_ASSIGNMENT.txt | Read source authority and restricted identity boundaries before any work. |
| CLI-03 Inventory supplied external-record sources | ls -l Incoming | Enumerate twelve released, source-specific files. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-04 Locate the preserved receipt key | jq -r '.local_reference_id' Incoming/remote_receipt_marker_student.json | Extract the precise remote reference ID used to correlate other sources. |
| CLI-05 Read the packet referenced by the marker | jq -r '.linked_packet.file_name' Incoming/remote_receipt_marker_student.json | Identify the packet name in the marker linkage. |
| CLI-06 Record when the marker object was created | jq -r '.created_timestamp' Incoming/remote_receipt_marker_student.json | Record the marker JSON creation time separately from provider event times. |
| CLI-07 Classify the status packet bytes | file Incoming/encrypted_status_packet.bin | Establish the format of the synthetic binary container. |
| CLI-08 Compute the binary packet SHA-256 | sha256sum Incoming/encrypted_status_packet.bin | Compute the full digest for the actual packet bytes. |
| CLI-09 Inspect the first 64 packet bytes | xxd -l 64 -g 1 Incoming/encrypted_status_packet.bin | Read the ASCII/hex training header without assuming decryption. |
| CLI-10 Search packet for printable labels | strings -a -n 16 Incoming/encrypted_status_packet.bin | Find the benign embedded training declaration among random bytes. |
| CLI-11 Check packet hash recorded in the marker | jq -r '.linked_packet.sha256' Incoming/remote_receipt_marker_student.json | Compare the embedded packet hash with the independently computed packet digest. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-12 Review provider CSV schema | csvcut -n Incoming/provider_access_log_student.csv | Read the actual columns before selecting status events. |
| CLI-13 Find the first pre-purge service access | csvgrep -c event_type -m pre_purge_service_access Incoming/provider_access_log_student.csv | Locate the 03:21:58 pre-purge status-access entry. |
| CLI-14 Project the full provider event chronology | csvcut -c event_id,timestamp,event_type,result Incoming/provider_access_log_student.csv | Observe the full set of ten provider ledger events before selective interpretation. |
| CLI-15 Locate the cache-cleared notice | csvgrep -c event_type -m cache_cleared_notice Incoming/provider_access_log_student.csv | Locate the provider status-only cache-cleared notice. |
| CLI-16 Find the later external receipt-marker event | csvgrep -c event_type -m remote_receipt_marker Incoming/provider_access_log_student.csv | Correlate the external receipt-marker event at 03:25:33. |
| CLI-17 Read the provider’s first-seen access time | jq -r '.service_status.first_seen' Incoming/provider_service_record_student.json | Cross-check pre-purge service access time using a second provider record. |
| CLI-18 Extract the provider broker-field label | jq -r '.routing_classification.broker_field' Incoming/provider_service_record_student.json | Identify the broker-field string preserved outside the cache. |
| CLI-19 Check the full provider export time | jq -r '.provider.export_timestamp' Incoming/provider_service_record_student.json | Record the 09:44 full-record export timestamp. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-20 Inspect the narrow preservation request | cat Incoming/preservation_request_draft.txt | Review drafted preservation scope and patient-data exclusions. |
| CLI-21 Identify the hold acknowledgment email subject | grep -F 'Subject:' Incoming/preservation_acknowledgment.eml | Read mail header data rather than treating an email as an actual provider login. |
| CLI-22 Find the provider hold identifier | grep -F 'Hold ID:' Incoming/preservation_acknowledgment.eml | Read the reported hold ID from the message body. |
| CLI-23 Corroborate the provider-side preservation flag | csvgrep -c event_type -m preservation_flag Incoming/provider_access_log_student.csv | Cross-check the email’s hold assertion with a separate provider ledger event. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-24 List the legacy trust report fields | csvcut -n Incoming/dead_account_trust_class_student.csv | Review account display, trust state, broker class and source limitations. |
| CLI-25 Isolate deceased account-state assertions | csvgrep -c account_state -m deceased Incoming/dead_account_trust_class_student.csv | Identify returned rows labeled with a deceased account state. |
| CLI-26 Compare source time, display and broker trust | csvcut -c report_id,timestamp,account_display,account_state,trust_class,broker_field Incoming/dead_account_trust_class_student.csv | Correlate the C. Marr display with deceased/civic/restricted trust, preserving time and row IDs. |
| CLI-27 Inspect the pre-purge broker query result | jq -r 'select(.event_type=="pre_purge_broker_class_lookup") | .result' Incoming/broker_query_events_student.jsonl | Observe the accepted broker-class lookup at 03:21:58. |
| CLI-28 Recover the municipal queue reference | jq -r 'select(.event_type=="municipal_relay_queue_status") | .queue_reference' Incoming/broker_query_events_student.jsonl | Identify a reduced municipal queue record for scoped follow-up. |
| CLI-29 Correlate protected-person verification rows | csvgrep -c query_target_category -m protected-person Incoming/protected_person_status_student.csv | Examine recorded protected-person status query category and progression. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-30 Record the municipal audit’s claimed export time | jq -r '.export_timestamp' Incoming/municipal_identity_audit_student.json | Read the reduced return timestamp and compare with later provider full-export time. |
| CLI-31 Inspect the reduced audit-field lead | jq -r '.audit_field_recorded.search_phrase' Incoming/municipal_identity_audit_student.json | Record the exact PRIMARY TARGET — STILL ALIVE audit phrase as a lead. |
| CLI-32 Read identity-disclosure status | jq -r '.audit_field_recorded.identity_disclosure_state' Incoming/municipal_identity_audit_student.json | Verify whether the provided audit identifies a target. |
| CLI-33 Read relevance-status limitation | jq -r '.audit_field_recorded.relevance_state' Incoming/municipal_identity_audit_student.json | Confirm whether a case-specific relevance decision is present. |
| CLI-34 Review reduced C. Marr account record | cat Incoming/account_state_summary_student.txt | Cross-check the account’s reported deceased state and supervision boundary. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-35 Create separate working and report areas | mkdir -p Evidence/Working Reports | Prepare permitted derived destinations without editing originals. |
| CLI-36 Create a byte-for-byte working provider ledger | cp Incoming/provider_access_log_student.csv Evidence/Working/provider_access_log_student.csv | Create a review copy distinct from Incoming. |
| CLI-37 Hash the source and derivative independently | sha256sum Incoming/provider_access_log_student.csv Evidence/Working/provider_access_log_student.csv | Observe both complete SHA-256 digests from current bytes. |
| CLI-38 Quietly compare source and derivative | cmp -s Incoming/provider_access_log_student.csv Evidence/Working/provider_access_log_student.csv | Compare the current two file byte sequences directly. |
| CLI-39 Confirm the immediately preceding comparison status | echo $? | Associate zero with the actual cmp command, not an unrelated prior command. |
| CLI-40 Preserve the pre-purge provider row in a CSV derivative | csvgrep -c event_type -m pre_purge_service_access Evidence/Working/provider_access_log_student.csv | tee Reports/pre_purge_access.csv | Preserve a bounded, reproducible provider access extract in Reports. |
| CLI-41 Reopen and verify the extracted CSV exists | cat Reports/pre_purge_access.csv | Inspect the current saved CSV derivative rather than a remembered console line. |
| CLI-42 Hash the preserved provider extract | sha256sum Reports/pre_purge_access.csv | Record the digest of the final source-labeled derivative. |
| Work order | CLI syntax | Purpose / interpretation |
|---|---|---|
| CLI-43 Inspect the cross-module event-index schema | csvcut -n Incoming/prior_module_event_reference_student.csv | Identify the crosswalk fields and preserve original event-source citations. |
| CLI-44 Order cross-module events by reported timestamp | csvsort -c reported_time Incoming/prior_module_event_reference_student.csv | Compare the ordered portal, provider, hospital and receipt milestones. |
| CLI-45 Sort the provider’s own ledger | csvsort -c timestamp Incoming/provider_access_log_student.csv | Examine the provider event sequence separately from later export timestamps. |
| CLI-46 Convert early provider event time to UTC | date -u -d '2211-09-18T03:21:58-06:00' '+%Y-%m-%dT%H:%M:%SZ' | Record the UTC equivalent while retaining the original source offset. |
| CLI-47 Preserve the claimed email Message-ID | grep -F 'Message-ID:' Incoming/preservation_acknowledgment.eml | Record the header value identifying the received acknowledgment message. |
| CLI-48 Read the provider-record availability notice | cat Incoming/PROVIDER_RETURN_AVAILABILITY.txt | Confirm which types of source and legal-process records were actually issued. |
| CLI-49 Independently hash the student marker derivative | sha256sum Incoming/remote_receipt_marker_student.json | Compute the issued marker derivative SHA-256 for comparison with original received-source references. |
| CLI-50 Create and verify a status-packet checksum manifest | sha256sum Incoming/encrypted_status_packet.bin > Reports/status_packet.sha256 && sha256sum -c Reports/status_packet.sha256 | Write an actual current digest into Reports and verify it against the packet. |