Unit VI Checkpoint: Preserve or Destroy?
Where you are: Unit VI — Evidence and Investigation · Checkpoint · About 12 minutes. This checkpoint draws on Lessons 6.1 to 6.5 and Chapter 21 of Dr. Al-Doori's Cyber Security Essentials.
Unit VI asked one question again and again: when something goes wrong, what do you keep, how do you keep it, and what can it really prove? Work through the three scenarios below. For each one, choose your answer, then read the model answer to check your reasoning. The scenarios are fictional.
Only inspect, test or change devices, accounts and systems you own or are explicitly authorized to work with.
Scenario 1: Your email was hacked — what do you save before cleaning up?
You have just got back into your email account through your provider's official recovery process. Inside, you find three things you did not create: a rule forwarding all messages containing "bank" to an unknown address, a new recovery phone number, and two messages in your sent folder asking friends for money. You want everything back to normal as fast as possible.
What is the best next move?
Model answer: c is right. Capture first, then clean up — in seconds, not hours. Dated screenshots and a short log entry preserve what your bank, provider or the police may need. Then remove the forwarding rule and the unfamiliar recovery number at once, because both keep the attacker connected to your account. Keep the sent messages (move them to a folder rather than deleting them) and warn the friends who received them through another channel. Then finish the playbook from Lesson 6.1: new unique password, sign out of all sessions, turn on MFA or a passkey. Option a destroys evidence, option b leaves your mail leaking to the attacker, and option d creates a new privacy risk.
Scenario 2: A drive copied without a write blocker
A company suspects an employee of taking confidential files. Wanting to help, a member of the IT team plugs the employee's laptop drive straight into an office PC and copies the "Documents" folder to a USB stick. Later, the company calls in a trained, authorised investigator.
What is the main problem with what the IT team member did?
Model answer: a is right. Connecting a drive to an ordinary computer without a write blocker can change it — even just by updating dates or system files. Copying one folder is a logical copy: it misses deleted files, slack space and free space, where important traces often hide (Lesson 6.3). There is also no hash taken at the start and no chain of custody, so the other side in a dispute can question whether anything was altered. The investigator should now make a bit-stream image through a write blocker, record a SHA-256 hash, document what has already happened to the drive, and keep a chain of custody from here on (Lesson 6.4). Options b, c and d ignore the risk that the original was changed and that the copy is incomplete.
Scenario 3: An IP address points to a café
Someone has been sending threatening messages to a classmate. A friend looks at an email header, finds an IP address in a Received line, and uses a free lookup website. The address belongs to the internet provider of a café near your college. The friend says: "So the sender is one of the café's staff — let's tell everyone."
What can you reasonably conclude?
Model answer: d is right. An IP address is a connection, often shared, not a person. A café's address is used by every customer on its Wi-Fi, possibly by people just outside, and lower header lines can even be faked (Lesson 6.5). Only the provider's records, requested by people with legal authority, can take the lead further — and even then, the account holder is not necessarily the person who typed the messages. The header is not worthless: keep the original message, record the header, date and time, and report it to the platform and the police. Naming the café's staff could seriously harm innocent people, which rules out options a and b.
Before you move on
If you chose the model answer in all three scenarios, you are ready for the Capstone. If not, revisit the lesson named in each model answer: 6.1 for what to keep while recovering, 6.4 for imaging, write blockers, hashes and chain of custody, and 6.5 for the limits of IP addresses and other clues.