Chapter 48 — Evidence dossier | Engineering Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 48 — Evidence dossier

Lesson map

Lesson 48 published. Map, example, EX142.

flowchart TD
  N0["Learning outcomes"]
  N1["48.1 Purpose"]
  N2["48.2 Contents"]
  N3["48.3 Index and identifiers"]
  N4["48.4 Claims table"]
  N5["48.5 Confidentiality"]
  N6["48.6 Review"]
  N7["48.7 Format"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX142"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["48.1 Purpose"]
  N2["48.2 Contents"]
  N3["48.3 Index and identifiers"]
  N4["48.4 Claims table"]
  N5["48.5 Confidentiality"]
  N6["48.6 Review"]
  N7["48.7 Format"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX142"]

[Learning outcomes]
    |
    v
[48.1 Purpose]
    |
    v
[48.2 Contents]
    |
    v
[48.3 Index and identifiers]
    |
    v
[48.4 Claims table]
    |
    v
[48.5 Confidentiality]
    |
    v
[48.6 Review]
    |
    v
[48.7 Format]
    |
    v
[Worked example] --> [Exercise EX142]

Learning outcomes

You will (1) assemble an engineering evidence dossier; (2) organise it for assessors and auditors; (3) link every claim to evidence; (4) protect confidential material.

48.1 Purpose

The dossier proves what the project achieved. It is the engineering equivalent of a forensic case file: every claim in the thesis must be traceable to a record in it.

A forensic case file lets someone who was not present check how a conclusion was reached; the dossier does the same for Priya's engineering claims. Assessors cannot rerun the pilot, but they can read its records. If a claim in the thesis has no supporting record, the dossier makes that visible. Building it as the project runs, rather than at the end, avoids reconstructing evidence from memory under deadline pressure.

48.2 Contents

Requirements and traceability matrix; design and decision records; threat and failure analyses; source code at the released tag; verification and validation reports; independent review and responses; pilot data and evaluation; failure trial report; debt register; meeting minutes.

The list mirrors the project's life: what was required, how it was designed, what could go wrong, what was built, how it was checked, what an outsider found, how it performed in use, how it recovered from failure and what remains unfinished. Meeting minutes record decisions that were never written elsewhere. Including the debt register shows assessors the project's known weaknesses alongside its successes, which supports rather than undermines its credibility.

48.3 Index and identifiers

Each document has an ID, version and hash recorded in a dossier manifest, so assessors can confirm they see what was submitted.

Hashes in the manifest let an assessor confirm, years later, that the file they open is the one submitted, using the same idea as image verification in the lab. Versions distinguish drafts from final documents. Identifiers like P-07 for pilot records keep references short in the thesis text. The manifest itself is hashed and that value is printed on the submission form, tying the whole set to one fixed point.

48.4 Claims table

A table lists each thesis claim with the dossier item(s) that support it, for example: "Zero examinations on unverified copies" → pilot records P-07, verification logs V-12.

The table works in one direction from claim to evidence, which is how an examiner reads a thesis. Each claim is phrased exactly as it appears in the text, so there is no gap between what was written and what was supported. Building the table also catches overstatement: when Priya cannot find a record for a sentence she wrote, she either adds the evidence or weakens the sentence to match what the records do show.

48.5 Confidentiality

All data in the dossier are synthetic or system records without case content. Lab-specific security details, such as network addresses, are redacted with a note.

Using synthetic or system records from the start means there is no case content that would need redacting later. Network addresses and similar details could help an attacker plan against Northfield, while adding nothing to the academic argument. A note at each redaction states what was removed and why, so assessors know the omission was deliberate. Northfield's manager reviews the dossier before submission to confirm nothing sensitive remains.

48.6 Review

Her supervisor samples ten claims and follows each to its evidence. One claim, about training hours, has no record; Priya adds the attendance sheet.

Sampling ten claims is a practical audit: checking every claim would take days, but a random sample reveals whether gaps are rare or common. The training-hours claim was true, since sessions happened, yet the record was missing, which in a forensic context would leave it unsupported. Priya then checks the remaining claims of the same kind herself and finds the dossier otherwise complete.

48.7 Format

Plain files with a readable index, so the dossier can be read in ten years without special software.

PDF for documents, plain text and CSV for data, and the source code as text files keep the dossier independent of particular programs. The index is a plain text file listing identifiers, titles, versions and paths. Proprietary formats, such as a spreadsheet with macros, are converted, and the conversion is checked by comparing totals. The same reasoning drove EvidenceDesk's own choice of plain JSON records.

48.8 Retention

The university keeps the dossier for the period its regulations require.

Retention periods allow appeals against degree results and support later audits of academic standards. Northfield keeps its own copy of the parts relevant to EvidenceDesk under the lab's records schedule, because validation evidence may be needed for as long as the system's records are used in court, which may well be longer than the university period. Priya keeps no copy of any lab-restricted material herself. Disposal at the end of that period is itself recorded.

Dossier walk-through

Before submission, Priya asks a classmate to pick five random claims and find their evidence unaided. Two took too long; she improves the index headings.

Worked example

The claims table row for the major review finding links the reviewer's report, the change commit, test T-ANCH-03 and the reviewer's confirmation email. The supervisor follows the trail in under five minutes.

Synthetic case. The dossier is invented.

Errors and limits

A dossier proves records exist; assessors still judge whether the evidence supports the claims.

Exercises

EX142 — Manifest role. Why hash dossier documents in a manifest? Rubric: 3 = assessors confirm documents are as submitted; 2 = partial; 1 = storage; 0 = none.
EX143 — Missing record. What did the supervisor's sampling find? Rubric: 3 = training hours claim lacked record; attendance sheet added; 2 = partial; 1 = vague; 0 = none.
EX144 — Redaction. What is redacted, and why? Rubric: 3 = lab security details such as network addresses; protect lab security; 2 = partial; 1 = everything; 0 = none.

Synthesis

A dossier with a manifest and a claims table makes every achievement checkable.

Continue studying — chapter 48 of 50

← Chapter 47 (draft) · Course chapter index · Chapter 49 (draft) →