Evidence Intake & Preservation
Preserve the received records, verify byte identities and distinguish received custody claims from independent handling.
Enter Module 01CLI Reference · 36 Commands ↗Novel ↔ evidence · Module 01 ↗NEW • Novel + Case Continuity Edition
Read the chapter. Investigate its aftermath.
The complete 169-page novel is supplied in the operation root above this Case folder. The twenty-chapter Evidence Reading Room connects scenes to all six lab modules and the exact case files, while keeping story narration separate from synthetic machine evidence, witness claims and analyst conclusions.
Read in sequence. The casebook contains chapter-specific spoilers. Six original terminal engines remain intact. The current release has 268 CLI work orders and 99 module-scoped evidence entries (including 14 capstone restorations); pre-existing source bytes remain unchanged.
Fictional evidence review · no live portal or medical-system access
One case. Six released investigations. Final capstone is Module 06.
Follow intake, the false reroute, apartment intrusion, hospital tamper, surviving receipt/broker records and the final analyst case reconstruction. All six investigations share portable progress while source provenance and module findings remain distinct. Only source-backed, actually completed findings belong in the case record.
01Evidence intake and preservation · unchanged release
02False medical reroute and C. Marr identity limitations · unchanged release
03Apartment intrusion, access logs and source conflicts · unchanged release
04Hospital tamper and read-only SQLite review · unchanged release
05Provider receipt, preservation and broker identity boundaries · corrected v1.1
06Complete examiner reconstruction and technical report · capstone release
Use care with case progress: Dashboard imported scores are locally supplied/self-reported. The individual Module 01–05 HTML files must replay their own command histories to verify them. This is not authentication of a student or a real forensic examination.
No case handoff loaded
Final analyst report has not been imported. This case segment is NOT yet concluded; the wider broker inquiry remains open.
To merge progress, import Module 01–06 exports one after another. If a module is already present, you will be asked before replacing that module alone. Your imported files never run operating-system commands.
The False Medical Reroute
Trace appointment changes, account-label approval, pending confirmation and contradictory email time wording.
Enter Module 02CLI Reference · 42 Commands ↗Novel ↔ evidence · Module 02 ↗The Apartment Intrusion
Correlate smart-home, access-control, concealed service routes and scene-response records; reconcile documented source conflicts.
Enter Module 03CLI Reference · 42 Commands ↗Novel ↔ evidence · Module 03 ↗The Sidecar & Hospital Event
Investigate the approved-cradle delay, restricted consent, unsupported adapter, correlated workstation/USB events, SQLite tamper metadata and irrecoverable cache loss.
Enter Module 04CLI Reference · 42 Commands ↗Novel ↔ evidence · Module 04 ↗The Remote Receipt & Brokered Trust
Review surviving receipt metadata, synthetic packet bytes, pre-purge provider access, preservation acknowledgments and limited broker/identity claims.
Enter Module 05CLI Reference · 50 Commands ↗Novel ↔ evidence · Module 05 ↗Case Reconstruction & Final Examiner Report
Correlate all six evidence chapters; disclose unresolved clocks, handling loss and limited sealed-language comparisons; close this examination segment with a source-labeled analyst report while the broader broker inquiry remains open.
Enter Module 06 · CapstoneExaminer report writing guideCLI Reference · 56 Commands ↗Novel ↔ evidence · Module 06 ↗TOOLBOX / PRINTABLE OFFLINE REFERENCES
CSI Linux CLI Reference Library
All 268 exact command work orders have refreshed printable references, derived from its exact command missions. Use these alongside the Tillshade-style left mission pane and realistic terminal. Syntax and tool explanations only; no command-output answers or instructor solutions.
Evidence Intake, Preservation & Integrity
Path and identity — pwd / ls / find / whoami, Read, identify and size — cat / file / stat, Search and preserve — grep -n -F / tee / wc, Preservation — mkdir / cp, File integrity — sha256sum / sha256sum -c, …
Open printable CLI reference →Enter interactive lab →The False Medical Reroute
Orient / enumerate — pwd, ls, find, cat, Structured JSON — jq -r, CSV audit — csvcut, csvgrep, csvsort, Email/header review — head, grep -n -F, Fictional event clock — date -d / date -u, …
Open printable CLI reference →Enter interactive lab →The Apartment Intrusion
Case context and source preservation — pwd, ls, find, cat, sha256sum, Quoted CSV audit — csvcut, csvgrep, csvsort, JSONL smart-home review — jq -r select(...), Scene and text-only artifact inspection — grep / cat, Copy and verify — mkdir, cp, sha256sum, cmp, echo, …
Open printable CLI reference →Enter interactive lab →The Sidecar & Hospital Incident
Authority and source review — pwd, ls, cat, Read consent and port status — jq, Forensic CSV correlation — csvcut and csvgrep, Read-only SQLite — sqlite3, Preservation and verification — mkdir, cp, sha256sum, cmp, echo, …
Open printable CLI reference →Enter interactive lab →The Remote Receipt, Preservation Gap & Brokered Trust
Shell orientation and scope — pwd, ls, cat, JSON/JSONL forensic extraction — jq, Structured provider/audit CSV — csvcut, csvgrep, Byte-level receipt fixture — file, xxd, strings, Preservation email and scope — cat, grep -F, …
Open printable CLI reference →Enter interactive lab →Case Reconstruction & Final Examiner Report
Orientation, paths and custody — pwd / ls / cat, Release provenance and SHA-256 — csvcut / csvgrep / sha256sum, Quote-aware chronology — csvsort / csvgrep, Loss and handling record — cat / grep / csvgrep, Reduced sealed comparison — csvcut / csvsort / csvgrep, …
Open printable CLI reference →Enter interactive lab →References open locally from the extracted student ZIP. Use your browser’s Print / Save PDF control for hard copies. The final Module 06 examiner report writing guide is available separately within the final module card.
Source-bound learning
Scope, records and inference
Module 02’s records claim a change from an official forensic consult to a wellness annex, a policy-accepted account-level approval and a later pending witness confirmation. The name in the approval field cannot verify a human operator.
The received email contains a weekday inconsistency and ambiguous “Tomorrow” wording. These remain source issues to evaluate, not silently corrected events.
Module 05 records support a surviving status receipt and pre-purge provider-side access; the deceased/civic/restricted account label and a protected-person search phrase remain unresolved as to human operator or target. Preservation acknowledgment is not disclosure.
Portable file handoff
One transferable case record
Import earlier progress first or later. The dashboard preserves unrelated modules and exports a combined file. For the unchanged Modules 01, 02, 03 and 04, select the corresponding compatible JSON export.
Earned findings only
Imported source-labeled observations
No earned findings imported.