Chapter 48 — Evidence dossier
Lesson map
Lesson 48 published. Map, example, EX142.
flowchart TD
N0["Learning outcomes"]
N1["48.1 Contents"]
N2["48.2 Retention"]
N3["48.3 Exclusions"]
N4["48.2b Third-party readability"]
N5["48.3b Redaction log"]
N6["48.1b Reader checklist"]
N7["Practice note"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX142"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["48.1 Contents"]
N2["48.2 Retention"]
N3["48.3 Exclusions"]
N4["48.2b Third-party readability"]
N5["48.3b Redaction log"]
N6["48.1b Reader checklist"]
N7["Practice note"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX142"]
[Learning outcomes]
|
v
[48.1 Contents]
|
v
[48.2 Retention]
|
v
[48.3 Exclusions]
|
v
[48.2b Third-party readability]
|
v
[48.3b Redaction log]
|
v
[48.1b Reader checklist]
|
v
[Practice note]
|
v
[Worked example] --> [Exercise EX142]
Learning outcomes
You will (1) assemble a dossier a third party can re-hash; (2) structure retention classes; (3) exclude dual-use material.
48.1 Contents
ROE PDF, ScopeVersion JSON, finding exports, evidence objects, hash manifest, tool versions, lab reports. Reader can verify without trusting your laptop.
"""Verify integrity of a synthetic evidence package."""
import hashlib, json
files = {
"roe.pdf": b"SYNTHETIC-ROE-v1",
"scope.csv": b"host,port\n10.20.1.10,443\n",
"findings.json": b'[{"id":"SYN-001"}]',
}
expected = {n: hashlib.sha256(b).hexdigest()[:16] for n,b in files.items()}
# Simulate tampering of findings.json
current = dict(expected)
current["findings.json"] = hashlib.sha256(b'[{"id":"SYN-001"},{"id":"TAMPERED"}]').hexdigest()[:16]
print(json.dumps(expected, indent=1))
for n in sorted(expected):
status = "OK" if expected[n] == current[n] else "MISMATCH"
print(f"{n:16} {status}")
Expected output:
{
"roe.pdf": "18d74983d403e7db",
"scope.csv": "01cc4815eddf3de6",
"findings.json": "7f5f178ab43ef00f"
}
findings.json MISMATCH
roe.pdf OK
scope.csv OK
A reader with the manifest and tool versions should re-hash without calling you. ROE, ScopeVersion, findings, evidence, labs and versions are the minimum set. Sam's dossier template fails a pack checklist if any of those folders is empty. Empty folders fail even when the README claims the data lives elsewhere. Elsewhere is not a folder name the checklist accepts.
48.2 Retention
Classes: engagement working (90 days), sealed evidence (agreed years), aggregate metrics (longer). Deletion jobs are tested.
Working, sealed and aggregate classes need different clocks and tested deletion. Untested deletion jobs are how personal cloud copies become the real archive. Sam's quarterly deletion drill restores from sealed storage after a purge of working files and checks the manifest still verifies. Deletion drills that skip sealed restore are incomplete. Incomplete drills reopen the retention ticket automatically. Automatic reopen keeps retention from becoming a once-a-year surprise.
48.3 Exclusions
No payloads, no live credentials, no personal data. If it cannot be shared with counsel safely, it does not belong.
Synthetic case — Riverstone Transit. Dossier v3 re-hashed clean after the findings.json incident; process note included.
After the findings.json incident, dossier v3 re-hashed clean and the process note explained the exclusion check that now runs before seal. The exclusion check is a script, not a memory item on seal day. Anything the script flags is removed and logged before the dossier is sealed, and the log entry names who approved the removal.
48.4 Errors and limits
Dossiers in personal cloud accounts fail residency and retention.
Personal cloud accounts break residency and retention schedules the host agreed. Sealed storage under host policy is mandatory. Sam's close-out greps for sync-agent paths on the jump host and fails if any dossier path sits in a personal folder. Personal folders discovered at close-out open an incident, not a quiet move. Quiet moves still page because the grep runs on a timer, not on honour. Timer interval is hourly during close-out week and daily otherwise.
48.2b Third-party readability
Hand the dossier to someone outside the project for a re-hash drill. If they cannot find the manifest or the ROE version, the dossier fails regardless of how neat it looks to its authors.
Authors know where they hid the manifest; outsiders do not. Sam's last drill failed when the ROE PDF was nested three folders deep without a pointer on the checklist page; the layout changed before seal. Layout reviews use the ten-minute budget as a hard gate. The outsider records how long the search took and where they got stuck.
48.3b Redaction log
When redacting, keep a redaction log (what, why, actor) inside the sealed store. Future readers need to know that a blank was intentional, not truncated evidence.
A blank without a log looks like truncation or tampering. Sam's redaction log for a screenshot that showed a staff display name records the pixel bounds, the privacy reason and his user id. Seal scripts treat a blank without a log as a hash mismatch equivalent. The log entry is written at the time of redaction, not reconstructed afterwards.
48.1b Reader checklist
Include a one-page "how to verify this dossier" at the top: install tool versions, run sha256sum -c manifest, open ROE, spot-check one finding. If readers need a tour guide, the dossier is incomplete.
Sam's assessor completed that path in under ten minutes on dossier v3, which became the time budget for layout reviews. Layouts that miss the budget are redesigned before the lead signs the manifest. The page names exact tool versions, so a reader months later can install the same ones. If a step needs a tool that is no longer available, the page says which version was used and where an archived copy is kept.
Practice note
Dossier builds are automated from tags: a make target produces the zip and manifest. Manual dragging of files into folders is how findings.json gets edited after seal. Automation makes the happy path the safe path.
Test restore from dossier on a clean machine once per term as a graded exercise.
Manifest generation fails the build if any path matches a forbidden-name regex.
Forbidden-name failures print the offending path so authors can fix quickly.
48.4b Integrity of the dossier
Each file in the evidence dossier is listed with its SHA-256 hash in a manifest, and the manifest itself is signed by the lead. A reader can confirm that nothing was added or changed after sign-off without trusting the storage location.
A signed manifest is what makes storage location irrelevant to integrity. Readers confirm bytes, not trust in a vendor folder. Sam's lead signature on the manifest is verified in the same checklist step as the file hashes. Signature verification failure blocks assessor sign-off the same way a bad file hash does.
Exercises
- EX142 — Manifest. Sketch a hash manifest format (3 rows). Rubric: 3 = path+algo+digest; 2 = digests only; 1 = vague; 0 = none.
- EX143 — Class. Assign retention class to ROE PDF vs scratch notes. Rubric: 3 = sealed vs working/delete; 2 = partial; 1 = same forever; 0 = none.
- EX144 — Exclude. What do you do if a student pastes a password into a finding? Rubric: 3 = scrub, rotate, process finding; 2 = scrub only; 1 = ignore; 0 = publish.
Synthesis
Dossiers are verifiable, classified and boringly safe.
Continue studying — chapter 48 of 50
← Chapter 47 (draft) · Course chapter index · Chapter 49 (draft) →