Part V Checkpoint: Run the Investigation
Where you are: Part V — Forensics in Practice: Scenarios, Software and Business Cases · Checkpoint · This checkpoint brings together Chapters 9 to 11 of Dr. Al-Doori's IT Forensics Essentials: investigation scenarios, forensic suites and business use cases.
Part V Checkpoint: Run the Investigation
You have finished Part V. This checkpoint puts you in charge of three investigations. For each one, read the scenario, choose what you would do, and then read the model answer. There is no score to record. Allow about 15 minutes.
All people and organizations below are fictional.
Scenario 1: Monday Morning Ransomware
A design studio arrives on Monday to find every file on its shared server encrypted, with a ransom note. The owner has three requests: get the business running today, find out how it happened, and decide whether to pay. There are backups from Friday night.
Which sequence best fits the book's ransomware scenario and modern practice?
Model answer: a. It follows the book's actions (malware analysis and IoCs, network forensics, file recovery with evidence preserved, prevention) in the right order, and adds the modern checks: was data stolen (double extortion), and does a free decryptor exist? Restoring first (b) or wiping everything (d) destroys the evidence of how the attackers got in, so the same door stays open. Paying first (c) skips the facts the decision needs and goes against the general advice not to pay.
Scenario 2: The Engineer, the Cloud and the Phone
A manufacturing company suspects that an engineer who resigned last week took a product design. He had a company laptop, access to the company's cloud file-sharing service and a personal smartphone, which he sometimes used for work email.
Which sources can the company examine on its own authority, and which need more?
Model answer: d. The laptop and the company's cloud tenant belong to the company, and its policies and the law will generally allow an investigation. Cloud audit logs may show downloads or sharing to personal accounts. The phone is his personal property: using it for some work email does not give the employer the right to examine it. That needs consent or legal process. Resigning (b) does not end the company's ability to examine its own systems.
Scenario 3: The Keyword Hit
In Autopsy, a regex search for the company's confidential part-number format finds 23 hits in unallocated space on the engineer's laptop image. The HR director asks you to confirm in your report that "he deleted the stolen design to cover his tracks".
What should your report say?
Model answer: c. Hits in unallocated space show that the data existed there at some point. They do not, on their own, show when it was deleted, by whom or why. Deletion can be routine: temporary files, program caches and ordinary editing all leave remnants. Report the facts, then look for corroboration, such as carved files, timestamps and USB or cloud records, before saying more. Option a states intent the evidence does not show. Option b is wrong: unallocated space is a classic source of evidence.
Before You Move On
If any of these felt uncertain, revisit the lesson behind it: Lesson 5.1 for ransomware, Lessons 5.2 and 5.5 for investigations of people and workplaces, and Lessons 3.5 and 5.4 for recovered data and Autopsy. Next, Part VI looks at professional practice: the forensic lab, the court report and the witness box.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapters 9–11
- CISA, MS-ISAC, FBI and NSA — #StopRansomware Guide (September 2023)
- No More Ransom (Europol, Dutch police and partners)
- NIST — IR 8354: Digital Investigation Techniques: A NIST Scientific Foundation Review (November 2022)
- UK Information Commissioner's Office — Employment practices and data protection: monitoring workers