1. What the final report must accomplish
Make the technical investigation reproducible. Another qualified analyst must be able to understand what was supplied, what you actually inspected, how you examined it, what the records assert, which assertions are corroborated, what conflicts, and what remains unknowable. A successful practice score does not substitute for a human technical review.
| Report component | Examiner-facing requirement |
|---|---|
| Scope and authorization | Specify the source set, examiner assignment and patient/consent boundaries. State excluded sources and actions. |
| Provenance and integrity | Item ID, original filename/path, source kind, hash algorithm, measured digest, observed file length and derivative lineage. A hash establishes byte identity, not authenticity. |
| Environment / methodology | Tool and bounded simulator version, commands executed, read-only/writable paths, export process and limitations on what the tool actually emulates. |
| Chronology | Original event time with supplied offset, UTC normalization where supported, clock provenance, sequence confidence and contradictory entries. |
| Results | Evidence-linked observations first; inference, competing interpretation and confidence second. Do not rely on question scores as evidence. |
| Evidence limitations | Unprovided media, absent identity proof, lost cache, source contradictions, timestamps that cannot be reconciled. |
| Disposition / handoff | What segment is technically complete; what investigation remains open; which custodian/request/records and time range will resolve each priority uncertainty. |
2. Evidence-to-claim writing method
For every material statement, distinguish these four levels:
| Level | Example of appropriate structure |
|---|---|
| Direct observed result | “The simulated command returned these bytes for source EVD-XX at examination time.” |
| Source record assertion | “The supplied event record labels the action as accepted.” |
| Corroborated technical event | “Two separately created log sources align on the time window and device identifier, subject to provenance limitations.” |
| Interpretation or unknown | “A hypothesis is supported, but the operator, mechanism, or intent cannot yet be independently established.” |
Include an alternative explanation and the precise authorized record that would distinguish it. Avoid automatically converting accepted to lawful access, sent to received by a human, a device warning to causal certainty, or a source label to an identified person.
3. Cross-module reconstruction worksheet
For each module, record the release source IDs, what was personally examined, the derived files, and open conflicts. Import earlier progress into Module 06 to include previously validated observations. If a module handoff is missing, mark it NOT IMPORTED rather than describing its findings as performed.
| Module | Record classes to cross-check | Key uncertainty method |
|---|---|---|
| 01 · Intake | Authority, custody, original bytes, scope | Rehash and classify received versus training derivative |
| 02 · Portal | Reroute, approver label, notification, confirmation | Compare policy/system records with human authorization |
| 03 · Apartment | Door, smart home, scene, responders, camera indexes | Separate machine assertion from independently supplied imagery/handling |
| 04 · Hospital | Consent, cradle, adapter, USB, SQLite, purge | Distinguish the first armed/locked event from later purge |
| 05 · Provider | Receipt, service access, status packet, trust class | Separate provider-side access, preservation, disclosure, identity |
| 06 · Capstone | Cross-source register, signed incident narrative, reduced comparison and limitation records | Use bounded sources to close the exam segment; never invent the unresolved actor |
4. Chronology and conflict discipline
Build a sortable table with the native event timestamp, stated offset, normalized UTC if defensible, source, event asserted, confidence, and conflicting event IDs. Use terms such as recorded, reported, corroborated, unknown and cannot determine precisely. An impossible sequence may indicate mistaken clocks, stale exports, transcription problems or source unreliability. It is not automatically evidence of malicious tampering.
When correcting a documented source error, never alter the original without a separately identified derivative, correction reason, version and new digest. Do not manufacture transport records, signed releases or missing image/audio bytes to make the chronology clean.
5. Lost evidence is not a recoverable exhibit
When a record indicates a sensory cache, index or event buffer was cleared, report what the surviving tamper record shows about the transition. Do not report nonexistent original memory contents, recovered voices/images, biometric identification or a reconstructed route. Distinguish a local marker, a sent status packet, and a provider-side receipt: each proves a different, limited proposition.
The investigator should also explain the documented handling deviation, the impact on the record, separate unaffected sources, any retained metadata, and the factual limits of attribution. Patient welfare, limited consent and review restrictions remain operational boundaries throughout technical reporting.
6. Technical peer-review readiness
- All sources in each finding have stable IDs and verified release digests.
- Every major claim includes a source, method, UTC/time-zone label and confidence level.
- The imported 01–05 progress is identified as student-controlled training state, not independent authentication.
- Unresolved contradictions remain clearly marked and are not silently chosen away.
- Negative findings are distinguished from missing or never-supplied evidence.
- Human actor, target identity and organization attribution are not inferred solely from displayed names, access classes or symbolic resemblance.
- No cleared sensory content, unsupplied media, live connection or unauthorized medical examination is claimed.
- The report is technically clear about what closes and what remains open.
- Next steps identify a specific custodian, artifact class, time window, legal/consent boundary and question to resolve.
- A second examiner can reproduce the documented offline methods and challenge every inference.