AUCSS / Digital Forensics 101
Hands-on investigation

Case UNI-24

A workshop attendance file changed from five names to six. Determine what changed, when it changed, and what the evidence cannot establish.

Question 1Which files match?
Question 2When did the extra name appear?
Question 3Who made the change?
01

Preserve the evidence

Create a working copy before examining anything.

  1. Keep student-lab.html beside the evidence folder.
  2. Open this folder in File Explorer.
  3. Right-click empty space and choose Open in Terminal.
  4. Run:
Copy-Item .\evidence .\working-copy -Recurse
Set-Location .\working-copy
Get-ChildItem | Select-Object Name, Length
Check

You are inside working-copy and can see E01 through E07 plus SHA256SUMS.txt.

02

Verify the files

Calculate SHA-256 values and compare them with the supplied manifest.

Get-FileHash .\E0* -Algorithm SHA256 |
  Sort-Object Path |
  Format-Table Hash, Path -AutoSize

Get-Content .\SHA256SUMS.txt
Check

Every calculated value must match the manifest. Stop and re-extract the pack if any value differs.

Expected hash pattern
FileSHA-256Result
E01642206b780054a1ec0a0939fe27139d1bb2d29152df983608c830607056d6331matches E03
E02c3dde3be8fcd1ea8b37e5210ac8d8411934c80e423b7dd8a7122984377b32f37different
E03642206b780054a1ec0a0939fe27139d1bb2d29152df983608c830607056d6331matches E01
03

Compare the attendance files

Find the exact content difference.

cmd /c fc /n E01-attendance-final.txt E02-attendance-submitted.txt
cmd /c fc /n E01-attendance-final.txt E03-attendance-backup.txt

Record the changed line and the matching pair.

Check result

E02 adds line 11: 6. F. Qureshi

E01 and E03: no differences.

04

Identify the real file type

Compare the filename with the first bytes.

Format-Hex .\E04-workshop-photo.jpg | Select-Object -First 2
Check

The filename ends in .jpg. The first bytes are 89 50 4E 47, the signature for a PNG file.

Extract the readable export comment.

$path = (Resolve-Path '.\E04-workshop-photo.jpg').Path
$text = [Text.Encoding]::ASCII.GetString(
  [IO.File]::ReadAllBytes($path)
)
[regex]::Match($text, 'Exported from CampusCam v2 on \d{4}-\d{2}-\d{2}').Value
Check result

Exported from CampusCam v2 on 2026-08-24

This text is file content. It does not prove when the image was captured.

05

Build the timeline

Order the log events and convert the message times to UTC.

  1. Show logins and uploads in time order.
Import-Csv .\E05-access-log.csv |
  Where-Object action -In 'login_failed','login_success','upload' |
  Sort-Object timestamp_utc |
  Format-Table event_id,timestamp_utc,account,action,source_ip,object_sha256 -AutoSize
  1. Read the messages.
  2. Convert M01 and M02 from PKT to UTC.
Get-Content .\E06-message-export.txt

([datetimeoffset]'2026-08-24T19:12:00+05:00').UtcDateTime
([datetimeoffset]'2026-08-25T12:06:00+05:00').UtcDateTime
Key correlation

L02 contains the E01/E03 hash. L09 contains the E02 hash.

Write the sequence from the first upload to the message about six names.

Check timeline
  • 24 Aug 14:11 UTC — L02 uploads the five-name version.
  • 24 Aug 14:12 UTC — M01 says five people attended.
  • 25 Aug 06:58 UTC — L07 records a failed login from 203.0.113.77.
  • 25 Aug 07:01 UTC — L08 records a successful login from the same address.
  • 25 Aug 07:03 UTC — L09 uploads the six-name version.
  • 25 Aug 07:06 UTC — M02 asks why the office copy has six names.
06

Check the handling record

Confirm who handled the evidence, when, and what action they recorded.

Import-Csv .\E07-custody-log.csv | Format-Table -AutoSize
Check

The record shows receipt, creation of a working copy, hash verification, and transfer of the training copy.

Does this record identify who used the workshop_lead account during L09?

07

Write the finding

Separate direct observations, supported conclusions, and limits.

Observed

State what the files show. Cite evidence IDs and event IDs.

Supported

State the conclusion that follows from those records.

Not established

State what these files cannot identify or prove.

Compare with the model finding

Observed: E01 and E03 have the same SHA-256 and contain five names. E02 has a different SHA-256 and adds F. Qureshi. E05 L02 links the five-name hash to the first upload. L09 links the six-name hash to a second upload after L07 and L08.

Supported: Two different versions of attendance.txt were uploaded. The six-name version appeared in the second upload at 07:03 UTC on 25 August.

Not established: These files do not establish who operated the workshop_lead account or who added the extra name.