Hand investigation a claim-to-source package and bounded queue

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Public activity · 30d

—Participating browsers

—Page views

—Reading sessions

—Exercise opens

Counts reflect browsers that allowed analytics. A reading session requires 30 seconds on a visible page. Browsers are not people.

Day 20 — Hand investigation a claim-to-source package and bounded queue

Theory and mechanism. A preservation handoff defines which claims an investigator can test next without improving the source by narration. Link each claim to its source/copy reference, receipt time, integrity/provenance status, inference limit and next accepting role. Keep the evidence ledger separate from a hypothesis table: observations remain traceable even when a preferred explanation changes. Preservation establishes usable inputs for investigation; it does not establish an actor or root cause.

At 09:22, C09 offers supplied identity detail associating s-77 with client runner-03, within the reported two rows. C03/C09 may motivate an identity correlation question, while C05 still has a blank session field and q-144. No direct session-to-application-request join has been supplied. C10 offers a pictured UI symptom with conditional time and unknown cache/context. C11/C12 have not arrived and must not appear as evidence in this handoff. A new analytical identifier can organize notes but cannot replace a missing producer identifier.

Worked contrast. “Evidence verified; runner-03 edited S42” promotes an incomplete receipt into a causal conclusion. A bounded alternative says: “C09 copy received according to the case at 09:18; original object/query/digest absent. Its supplied rows associate s-77 with runner-03, but C05 supplies no matching session field. C10 received at 09:22 depicts an unavailable UI; backend and capture context unverified. Preserve these limits while requesting source-specific discriminators.” The latter is actionable because it names the next missing evidence, not merely “investigate further.”

Build a two-request queue using loss risk and decision value, not the number of blank cells. First, ask the identity custodian under the actual approval to supply C09's source object/version, exact selectors and method, collection/transfer history and byte count/digest if measured. If a fresh collection or wider scope is needed, seek its own approval rather than presuming the old approval covers it. C08 reports 10:00 expiry; at 09:22 the nominal interval is 38 minutes, but no guaranteed execution budget or source hold follows from that arithmetic. A custody gap remains a gap after expiry unless supported later evidence resolves it.

Second, seek a permitted, minimized authoritative S42 state/version and relevant last-change reference from the application/service owner. State which source is authoritative and when the read is performed; a future current-state observation is not a measured historical value. These requests can be handled in parallel if custodians and permissions allow. Rank identity preservation first under the supplied loss warning, but permit a justified alternative scheduling if an owner identifies a more urgent service consequence. Do not drop the first request's deadline merely because the state check is easier.

Review trigger and stopping rule. Propose a supervisor review at 09:30, earlier if a usable receipt or verified major service harm arrives. This is a new proposed checkpoint, not a CTN card or observed action. If the accepting custodian, permission or method is missing, escalate the blocked request and document the residual loss risk. If a digest mismatch appears in a future check, retain the discrepant versions and seek an authorized comparison; do not overwrite a copy or declare intentional tampering. Keep the distinction between source hold, case copy, derivative and checked result visible.

Practice and limit. Complete EX020: two bounded requests, review/stop conditions and a short source-linked handoff at 09:22. Use the worked answer to test whether another analyst can identify the unknowns without inventing a completed operation. This package prepares Chapter 5's hypotheses and timeline; it does not close the case or release later cards.

Continue studying — course Day 20: Previous: Day 19 · Week 4 index · Course index · Next: Week 5, Day 21.

Exercise for this lesson

EX020 — Preservation queue. Objective: hand investigation a source-linked, executable-under-approval plan. Input: C08–C10, relevant earlier cards and the S42 question at 09:22; no C11 or later card. Rank two bounded follow-up requests by reported loss risk and decision value. For each name the accepting custodian, supplied versus pending approval, scope, discriminator, next receipt and review/stop condition. Add a 90–150-word handoff identifying C09/C10 limits and the missing session-to-request join. A proposed review time is not a new case observation; a future current-state read does not establish historical state. Rubric: 0 = invented result/permission or causal attribution; 1 = plausible two-request queue with incomplete source, authority or reassessment fields; 2 = actionable bounded queue and honest handoff with distinct preservation and state questions. Justified scheduling alternatives may pass if they retain the loss warning and permission boundaries. Worked answer.

Practice the exercises

Open a prompt, write your response, then compare it with the worked answer. Five-choice practice appears where a reviewed question is available.

EX020

Open the prompt →Compare with the worked answer →

Opens in 30 days: — · browsers: —

Checking for a reviewed five-choice question…

Worked answers

EX020 — Model queue. First ask the identity custodian, under the case approval, for the C09 source object ID, exact bounded query, byte count/digest and collection method before the stated 10:00 source expiry; this can determine whether an analysable copy exists. In parallel ask the service/application owner for an approved read-only S42 authoritative-state and last-change check with minimal fields; it can distinguish current state from a displayed symptom. Neither follow-up result has arrived in the case at 09:22. Reasonable ordering can differ if the learner preserves the deadline, authority and discriminator.

Additional worked reasoning (EX020 — Decision-oriented two-source queue.): Request the C09 producer/export metadata and actual bounded query/collection receipt from the identity custodian under the existing approval, before the reported 10:00 expiry when possible. Separately request an authorized read-only S42 current version/value and last-change reference from the application/service owner, with minimal fields. The first improves evidence availability/provenance; the second informs business impact. They can proceed in parallel if custodians and permissions permit, but neither result was supplied at 09:22. Preserve those distinct questions instead of broadening the export.

C4 byte-integrity extension — worked laboratory result.

C4|length 34 SHA256 1407e98f466990ff5aa4eee42cd30291826490e2c910ee57887824e6946136cc
C4|mutated_length 34 SHA256 c4ad3cfb2707356a80767e6555ce8c7ff92f7ef549d8f128468de23a1ce13e61
C4|equal_digests False

The 34-byte V4 fixture and one-byte variant have identical lengths but different SHA-256 values. This establishes a difference between those classroom byte strings only. C09's original object, method, byte count and digest remain unavailable; the V4 digest must never populate its evidence receipt. A correct EX018 explanation keeps source authenticity, completeness and decision relevance distinct from byte integrity.

Week 4 Day 20 — worked queue and handoff.

Lesson table; scroll horizontally to read all columns →

Proposed request	Role and authority	Next evidence / discriminator	Review and stop condition
C09 bounded acquisition clarification	Identity custodian under the supplied case approval; confirm whether any fresh/wider operation needs another decision	Source object/version, exact query/method, acquisition/transfer record and actual byte count/digest if measured; distinguish received copy from complete producer scope	Before reported 10:00 loss when possible; propose 09:30 supervisor review and escalate earlier if acceptance/method is blocked; never silently widen scope
S42 authoritative-state and last-change comparison	Application/service owner; an approved read-only method is still to be established in this case	Minimal status/value, version/request reference, source and read time; distinguish current state from screenshot interpretation	Review on actual result or 09:30 proposal; stop if permission/source meaning is unclear; do not backdate a future read

These are requests, not new case receipts. Identity work is ranked first under the source-loss warning; concurrent scheduling is acceptable with distinct custodians and permissions. At 09:22, 38 nominal minutes remain to C08's reported expiry, but neither a guaranteed execution window nor a working source hold is supplied.

Model handoff: “At 09:22, C09 supplies a received IdP copy with reported 09:16 approval, but source object, query and byte checks remain missing. Its two supplied rows associate s-77 with runner-03; they do not join that session to q-144. C10 depicts S42 unavailable with conditional 09:21 UTC display time; capture clock, cache and authoritative state are unverified. Ask the identity custodian for bounded acquisition metadata before the reported 10:00 expiry, confirming any new operation's permission. Separately seek an approved application-owner S42 value/version and last-change comparison. Propose review at 09:30 or earlier on a usable receipt or verified major harm. No new collection, state result or account action is claimed.”

This message carries claim-to-source limits into investigation. C11/C12 are unavailable, and neither request's expected result can be written as received. Current-state evidence may inform impact while historical cause still needs its own validated identifiers and time basis.