OpenCyber Academy
Bachelor's · Chapter 37 · English
Course code: OCA-109Chapter 37: OCA-109-C037

Chapter 37 — Evidence review seminar

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 37 published. Map, example, EX109.

flowchart TD
  N0["Learning outcomes"]
  N1["37.1 Seminar format"]
  N2["37.2 Review criteria"]
  N3["37.3 The defence perspective"]
  N4["37.4 Feedback"]
  N5["37.5 Receiving feedback"]
  N6["37.6 Leah's review"]
  N7["37.7 Culture"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX109"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["37.1 Seminar format"]
  N2["37.2 Review criteria"]
  N3["37.3 The defence perspective"]
  N4["37.4 Feedback"]
  N5["37.5 Receiving feedback"]
  N6["37.6 Leah's review"]
  N7["37.7 Culture"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX109"]

[Learning outcomes]
    |
    v
[37.1 Seminar format]
    |
    v
[37.2 Review criteria]
    |
    v
[37.3 The defence perspective]
    |
    v
[37.4 Feedback]
    |
    v
[37.5 Receiving feedback]
    |
    v
[37.6 Leah's review]
    |
    v
[37.7 Culture]
    |
    v
[Worked example] --> [Exercise EX109]

Learning outcomes

You will (1) review another student's findings critically; (2) apply evaluation criteria for forensic conclusions; (3) give constructive feedback; (4) receive and act on feedback.

37.1 Seminar format

Each student presents capstone findings; two peers act as reviewers, one playing a defence expert. Dr Ferreira moderates.

Assigning one peer to play the defence expert makes challenge a normal part of the seminar rather than a personal attack. Each presenter knows in advance which questions to expect and must answer them from the evidence. Dr Ferreira keeps time and ensures every finding gets at least one question before the session moves on to the next presenter. Each presenter gets the same time.

37.2 Review criteria

Is each finding sourced? Is the interpretation supported by tested knowledge of the artefact? Were alternatives considered? Are times normalised? Are limits stated? Is language calibrated? These echo ISO/IEC 27042's concern with supported, reviewable interpretation.

Each criterion can be answered yes or no for each finding, which makes the review systematic. A finding that fails any criterion is returned with a specific request. The criteria match Leah's checklist from the recurring errors, so students who used it throughout the course find few surprises in the seminar.

37.3 The defence perspective

The "defence expert" asks: Could someone else have used the account? Could the clock offset be wrong? Was the tool validated for this artefact? Good findings already answer these.

Each of these questions has an answer in the ws-114 evidence: the account question is addressed by limiting conclusions to account context; the offset question by the BIOS photo and the agreement between corrected and proxy times; the tool question by the verification table. Students who cannot answer from their notes know where their work needs strengthening.

37.4 Feedback

Feedback names the finding, the issue and a suggestion: "F7: the foreign sign-in is sourced, but geolocation limits are not stated; add a sentence on VPNs."

The example names the finding (F7), the issue (geolocation limits not stated) and a fix (a sentence on VPNs). An IP address that geolocates abroad might belong to a VPN service used by someone nearby, so the finding must say what the location shows and what it does not. Specific feedback is quicker to act on than general comments.

37.5 Receiving feedback

Presenters record each comment and their response: accepted and changed, or disagreed with reason.

Disagreeing with a reason is acceptable; ignoring a comment is not. Recording responses lets Dr Ferreira see that every comment was considered. Leah's response to the offset question, adding a limitation, is an example of accepting a point and changing the report accordingly. Her response to a suggestion to drop the sensitivity exercise for time, by contrast, was a reasoned disagreement: the exercise is the project's original contribution. Both responses are recorded in her table with the reviewer's name.

37.6 Leah's review

Her "defence" reviewer asks how she knows the 47-second offset applies throughout the period. She has one BIOS photo at seizure. She adds a limitation and notes that consistency between corrected times and proxy times supports the offset.

Agreement between corrected endpoint times and independent proxy times is indirect evidence that the offset held: if the clock had drifted significantly, the corrected browser time would no longer match the proxy POST. She cannot prove constant drift from one photo, so she states the limitation and its support together. The lesson, measure offsets at more than one point, goes into her method reflection.

37.7 Culture

Critique targets work, not people.

In practice this means comments refer to findings and evidence, not to the presenter's ability. A reviewer says "F7 does not state geolocation limits" rather than "you forgot". Dr Ferreira intervenes if a comment becomes personal. Students who feel safe presenting work with flaws learn more than those who hide them, and the same culture is what Grace's team aims for in blameless reviews. Leah notices that the seminar's tone made her more willing to show weak points in her own work.

Presenting under questioning

Presenters practise answering briefly and returning to evidence: "The finding rests on these two artefacts; here is the limit." Leah learns that saying "I did not examine that" is better than guessing, and that a calm, sourced reply persuades more than a confident claim.

Worked example

Reviewing a peer's report, Leah finds "the attacker exfiltrated the file share". The evidence shows no file share logs. She suggests: "File share access could not be assessed because access logging was disabled."

Synthetic case. The seminar is invented.

Errors and limits

Peer review catches many errors but shares the group's blind spots; external review adds independence.

Exercises

Synthesis

Structured peer review with a defence perspective strengthens findings before they leave the team.

Continue studying — chapter 37 of 40

← Chapter 36 (draft) · Course chapter index · Chapter 38 (draft) →

Worked answers

EX109. Each finding is sourced, its interpretation is supported, alternatives were considered, and limits are stated (times normalised and calibrated language also count).

EX110. She added a limitation about having only one clock measurement and pointed out that corrected endpoint times agree with independent proxy times.

EX111. "File share access could not be assessed because access logging was disabled."