NewAI Content Creation is now live in Early Access
Turning Point Training Instituteby Training Center
Catalog
Skip to content
0%
OrientationLesson 2 of 2
9 min readBeginner

Where you are: Orientation · Lesson 0.2 · This lesson sets the ground rules for the whole course, helps you prepare an optional practice toolkit, and gives you a starting point to compare against at the end.

What you'll be able to do

By the end of this lesson you will be ready to start the course safely and lawfully, and you will have a private record of your starting instincts.

  • State the three ground rules every forensic examiner works by: authority, privacy and never touching the original.
  • Prepare an optional, free practice toolkit and safe practice data.
  • Take an ungraded forensic instincts check that you will repeat at the end of the course.

Ground Rule 1: Authority Comes First

In Dr. Al-Doori's book, the investigator never searches without authority. In criminal cases that usually means a warrant, an order from a court that says what may be searched and for what. In a company, it means documented permission from the organization that owns the systems, given under its policies and the law. Even with authority, you stay within its scope: if you are looking for fraud and come across something unrelated, you stop and seek further authority. Part I explains why going outside scope can get evidence thrown out of court.

There is a second reason the rule matters. Accessing a computer or account without permission is a crime in many countries. Examples include the UK's Computer Misuse Act 1990 and the US Computer Fraud and Abuse Act. Good intentions are not a defense. So the rule for this course is simple:

Only examine devices, accounts and systems you own or are explicitly authorized to work with. Do not practice on a friend's phone, a family member's laptop, your employer's systems or any account that is not yours.

Ground Rule 2: Privacy and Proportionality

Forensic tools can reveal far more than anyone typed: deleted files, browsing history, locations and conversations. Investigators look only for what their authority covers and protect everything else they see. In this course you will never be asked to share real passwords, personal files, photos, messages, account names or screenshots of your devices. Everything you do in practice stays private, on your own machine.

Ground Rule 3: Never Work on the Original

The first habit of a forensic examiner is to protect the original evidence and work on an exact, verified copy. You will learn why in Part I and how in Part II. Start the habit now: when you practice, use a spare USB stick that holds only test files you create for the purpose, never your main drive or anything you cannot afford to lose.

Your Optional Practice Toolkit

Nothing in this course requires software. Every hands-on activity has a reading-only alternative. If you would like to practice, these are free and come from their official publishers:

  • Built-in hashing commands. Windows PowerShell has Get-FileHash. macOS has shasum -a 256 in Terminal. Most Linux systems have sha256sum. You will use these in Lesson 2.1.
  • Built-in hex viewers. Windows PowerShell has Format-Hex. On macOS and Linux, xxd or hexdump usually come preinstalled. You will use these in Lesson 2.2.
  • FTK Imager. A free imaging and preview tool for Windows from Exterro. The download is free but asks you to fill in a short form. You will explore it in Lesson 2.6.
  • Autopsy. A free, open-source forensic platform from Sleuth Kit Labs. Windows has an installer; Linux and macOS need some extra setup steps described on the official download page. You will open a practice case in Lesson 5.4.
  • Practice data. NIST's Computer Forensic Reference Data Sets (CFReDS) publish fictional, legal practice cases. One classic is the "Hacking Case", an image of an abandoned laptop with a set of questions to answer. The full raw image is about 5 GB, in eight parts, and the E01 version is about 1.1 GB, so check your disk space before downloading. You will use it in Lesson 5.4 and Capstone A.
  • A spare USB stick with a few harmless test files you create yourself: a short text document, a photo of a houseplant, a spreadsheet of made-up numbers.

Install software only on a computer you own, from the official websites linked in Sources.

Real-World Example

Imagine (a fictional scenario) a well-meaning office manager who suspects a colleague of leaking client files. Over the weekend she logs into the colleague's laptop, opens folders, reads emails and copies "anything suspicious" to her own USB stick. On Monday the company calls in a professional investigator.

The investigator now has three problems. The manager had no documented authority to search, so the company's lawyers worry about privacy law. Browsing the laptop changed file access times and other traces, so it is harder to show what the colleague did as opposed to what the manager did. And the copies on her USB stick have no record of how they were made, so their integrity cannot be proven. A five-minute phone call to the right person before touching the laptop would have avoided all three. That is the instinct this course builds.

Your Forensic Instincts Check

Answer the five questions below honestly, before you study anything else. This check is ungraded and private. Note your answers somewhere only you can see. You will meet the same ideas again at the end of the course and can compare your instincts then with your instincts now.

You arrive to help with a running laptop that may hold evidence. What is the best first move?

Two copies of a drive produce exactly the same SHA-256 hash value. What does that tell you?

While searching a laptop for evidence of fraud under a warrant, an examiner notices files that look like evidence of a different crime. What should happen?

A file was deleted from a computer's hard drive last week. Which statement is most accurate?

Your analysis supports one conclusion, but a detail does not fit. What belongs in your report?

Answers explained

  • Question 1: c. Opening files changes the evidence and switching off may lose memory contents or lock an encrypted drive. Record first, then follow the procedure. Copying folders (d) changes things and produces copies whose integrity cannot be proven. Lessons 1.3, 1.4 and 3.4 return to this.
  • Question 2: a. Matching hashes show the data is identical. They say nothing about malware, ownership or how the evidence was collected (b, c, d). Lesson 2.1 explains why.
  • Question 3: c. Authority has a scope. Going beyond it can make evidence inadmissible, but ignoring or deleting what you saw (b, d) is also wrong. Record it and seek further authority. Lesson 1.4 covers scope.
  • Question 4: b. Deletion usually removes the file's entry, not its contents, so recovery is often possible on hard drives, though not guaranteed. Solid-state drives behave differently. Lessons 2.3 and 3.5 explain.
  • Question 5: a. An expert reports what the evidence shows, including what does not fit and what cannot be concluded. Lessons 4.1 and 6.3 explain why this matters so much.

What Would You Do?

A friend learns you are taking a forensics course and asks you to "check" their partner's phone for them. They promise the partner would not mind. What do you say? Think it through privately before reading the model answer below.

Model answer: Decline. You do not own the phone and the person who does has not given you permission, so examining it would break this course's first rule and could break the law. If your friend has a genuine safety concern, the right route is a professional service or the police, who act under proper authority.

Key Takeaways

  • Authority comes first: a warrant, court order or the owner's documented permission, and only within its scope.
  • Protect privacy: look only for what your authority covers, and keep practice private.
  • Never work on the original: practice on a spare USB stick with test files, or on public practice data.
  • The practice toolkit is free and optional: built-in hash and hex commands, FTK Imager, Autopsy and NIST CFReDS.

Sources

Next
PreviousWelcome: Dr. Tahseen Al-Doori's IT Forensics EssentialsNextWhat Is Computer Forensics?