Part IV Checkpoint: Integrity Under Pressure
Where you are: Part IV — Integrity: Ethics, Write-Blockers and the Language of Security · Checkpoint · This checkpoint brings together Chapters 6 to 8 of Dr. Al-Doori's IT Forensics Essentials: ethics, write-blockers and the language of security.
Part IV Checkpoint: Integrity Under Pressure
You have finished Part IV. Integrity is easy when nobody is pushing. This checkpoint gives you three situations where someone is. For each one, read the scenario, choose what you would do, and then read the model answer. There is no score to record. Allow about 12 minutes.
All people and organizations below are fictional.
Scenario 1: Two Tools, Two Answers
You are examining a suspect's browser history in a fraud case. Your main forensic suite reports that a banking website was visited 27 times on the day in question. A second tool, run as a cross-check, reports 9 visits. The trial is next week, and the prosecutor prefers the higher number.
What should you do?
Model answer: c. This is the Casey Anthony lesson from Lesson 4.1: two tools, two answers, and a wrong number put before a jury. Neither tool is automatically right. Go to the raw records, understand why the counts differ (for example, one tool may count page loads and the other visits), test against data where you know the true answer, and report transparently. Options a and b pick a number for convenience. Option d hides relevant evidence.
Scenario 2: No Write-Blocker Today
Your lab's only hardware write-blocker failed its morning self-test. A manager tells you to image an urgent evidence drive anyway, by connecting it directly to your workstation: "It's just this once, and nobody will know."
What is the right response?
Model answer: c. The write-blocker's job is to make sure nothing is written to the evidence. Imaging without one risks changes you cannot later explain, and the documentation must always be truthful. Option b is falsifying records, an ethical violation under the book's integrity and documentation issues. Options a and d risk altering the evidence. If the case truly cannot wait, a tested software write-block method may be acceptable, with every step documented.
Scenario 3: "While You're In There…"
You are examining a company laptop under written authority, investigating whether an employee leaked a product roadmap. The HR director phones: "While you're in there, can you also check whether she's been looking for other jobs, and whether there's anything about her health? We're thinking of letting her go anyway."
What should you do?
Model answer: d. Your authority covers the roadmap leak. Job searching and health information are outside it, and health data is especially sensitive under privacy laws such as GDPR. Owning the laptop (a) does not make any search lawful or proportionate. Hidden work (c) breaks the duty to document everything. Option b still exceeds scope. Refer the request to the people who can lawfully decide, and write down that it was made.
Before You Move On
If any of these felt uncertain, revisit the lesson behind it: Lesson 4.1 for the ten ethical issues and the cases behind them, Lesson 4.2 for write-blockers and testing, and Lesson 4.3 for the language of security. Next, Part V puts everything to work in realistic investigations, business cases and a full forensic suite.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapters 6–8
- NBC News (New York Times) — Was Casey Anthony prosecuted with inaccurate data? (July 2011)
- NIST — Computer Forensics Tool Testing Program (CFTT)
- EUR-Lex — Regulation (EU) 2016/679 (General Data Protection Regulation)