◇ OpenCyber Academy
Technologist · Chapter 9 · English

Chapter 9 — Evidence and measurement

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Evidence and measurement

Lesson map

Lesson 09 published. Map, example, EX025.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Evidence is a claim's support"]
  N2["9.2 Chain of custody"]
  N3["9.3 Hashing as a tamper check"]
  N4["Lab C — evidence manifest"]
  N5["9.4 Measurement needs units"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX025"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Evidence is a claim's support"]
  N2["9.2 Chain of custody"]
  N3["9.3 Hashing as a tamper check"]
  N4["Lab C — evidence manifest"]
  N5["9.4 Measurement needs units"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX025"]

[Learning outcomes]
    |
    v
[9.1 Evidence is a claim's support]
    |
    v
[9.2 Chain of custody]
    |
    v
[9.3 Hashing as a tamper check]
    |
    v
[Lab C — evidence manifest]
    |
    v
[9.4 Measurement needs units]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX025]

Learning outcomes

You will (1) write a chain-of-custody note for a digital artefact; (2) compute and verify a SHA-256 manifest; (3) explain why measurement needs a defined unit and a defined time window; (4) refuse to keep engagement evidence on personal devices.

9.1 Evidence is a claim's support

A finding without evidence is an opinion. Evidence can be a configuration export, a redacted screenshot, a log excerpt or a hash of a file. Capture only what proves the point; more data means more retention risk and more redaction work.

In ENG-712 the claim about the portal banner enters the report because E-001 has a matching digest. An opinion about the banner without that file is deleted in peer review. Priya captures evidence only on authorised systems and masks staff local parts before filing, so the evidence proves the point without adding retention risk.

9.2 Chain of custody

For each item record who collected it, when, from where, and every hand-off. NIST SP 800-86 describes integrating forensic techniques into incident response; the same discipline of labelling and integrity checking applies to assessment evidence even when the legal stakes are lower.

Custody lines for ENG-712 name who exported E-001, when, and from which host. Hand-offs to Jordan as evidence owner are logged. NIST SP 800-86 habits transfer even when the case is synthetic. A missing custody line blocks the board-pack export even when the hash matches.

9.3 Hashing as a tamper check

A SHA-256 digest of an artefact, stored separately from the artefact, lets a later reader detect silent edits. If the digest no longer matches, the file changed — intentionally or not — and the claim that relied on it must be revisited.

The lab shows E-001 MATCH and E-002 MISMATCH. The mismatch stopped a claim about a wiki password until the export was taken again under two-person review. Digests are stored beside the evidence files rather than only in a ticket thread that anyone can edit, so a later reader can still check them.

Lab C — evidence manifest

"""Lab C (ch 09): build a SHA-256 evidence manifest for synthetic artefacts and detect tampering."""
import hashlib
artefacts = {
    "E-001_portal_login_banner.txt": b"TRT staff portal - authorised users only\n",
    "E-002_wiki_page_export.txt": b"Runbook draft v3 (synthetic)\n",
}
manifest = {name: hashlib.sha256(data).hexdigest() for name, data in artefacts.items()}
for name, h in manifest.items():
    print(f"{h[:16]}...  {name}")
artefacts["E-002_wiki_page_export.txt"] = b"Runbook draft v4 (synthetic)\n"  # simulated later edit
for name, data in artefacts.items():
    ok = hashlib.sha256(data).hexdigest() == manifest[name]
    print(name, "MATCH" if ok else "MISMATCH")

Run with python3 lab_hash.py. Verified output:

3b5ca57a4755e156...  E-001_portal_login_banner.txt
ce711fb5a92e12ef...  E-002_wiki_page_export.txt
E-001_portal_login_banner.txt MATCH
E-002_wiki_page_export.txt MISMATCH

9.4 Measurement needs units

"We scanned a lot" is not a measure. "Seven ATT&CK techniques exercised between 22:00 and 05:00; three alerted, two logged, two missed" is a measure. Chapter 19 builds a coverage matrix; this chapter only insists that numbers have units and windows.

ENG-712's purple slide uses exactly those counts for seven techniques. A coverage percentage without units or a window would invite the CISO to compare numbers that mean different things. With counts per category, the investment conversation can start from the two missed techniques and ask what log source or alert would close each gap.

Worked example

Priya hashes two synthetic exports before filing them. Later someone "updates" the wiki export. The manifest check prints MISMATCH for that file and MATCH for the untouched banner. She treats the wiki export as unreliable until a fresh copy is taken under custody.

Synthetic case. The two artefacts and the later edit are invented for the lab.

Errors and limits

Hashes detect change; they do not prove the original was true. Personal chat apps and personal laptops are not evidence stores.

Exercises

Synthesis

Minimise, label, hash, measure with units, and never park evidence on personal devices.

Continue studying — chapter 09 of 30

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →