NewAI Content Creation is now live in Early Access
Turning Point Training Instituteby Training Center
Catalog
Skip to content
0%
CapstoneLesson 2 of 3
15 min readBeginner

Where you are: Capstone · C.2 · About 2 hours. This capstone applies the whole course, especially Parts II, III, V and VI of Dr. Al-Doori's IT Forensics Essentials: Windows artifacts, timelines, hash matching, business investigations, court reports and testimony.

This case is entirely fictional. Every person, organization, domain, address and value below was invented for this exercise. Domains use reserved example names, and IP addresses come from ranges reserved for documentation. Only examine devices, accounts and systems you own or are explicitly authorized to work with.

What you'll be able to do

You will take a realistic intellectual property case from evidence packet to court-ready report.

  • Build a sourced timeline from Windows, cloud, email and physical-access records.
  • Assess the integrity of each item, including a weakness in the chain of custody.
  • Write a court-style report that separates findings from interpretation and states its limits.
  • Answer cross-examination questions within the evidence.

The Case

Kelvorn Turbines Ltd designs wind-turbine blades. Its next design, T-900, is confidential. On 12 June 2026, a senior engineer, Tomás Albright, resigned with immediate effect and joined a competitor, Brindlecove Energy. On 22 June, Brindlecove presented a blade design that Kelvorn's engineers say closely resembles T-900.

Kelvorn's General Counsel has given written authority to investigate Kelvorn's own systems: the company laptop LT-114 issued to Albright, and Kelvorn's cloud file-sharing and email services. Albright's personal phone and home computer are not within the authority and have not been examined. You are the examiner. All times are UTC.

The Evidence Packet

Item 1: Acquisition and custody of laptop LT-114

code
12 Jun 17:30  LT-114 returned to IT manager R. Osei at exit meeting.
              Placed in IT manager's office cupboard (not locked).
              No custody entries until 15 Jun.
15 Jun 10:05  Collected by examiner; sealed in bag 66310.
15 Jun 10:40  BitLocker recovery key retrieved from Kelvorn's directory
              service. SSD imaged through tested hardware write-blocker.
              Format E01.
              Source data SHA-256:
              462d20393edce9fd3763f2bd477a6c67b9c93f59cd2bc1bf0236c1c802e37eea
              Verified image SHA-256: identical. Verification: MATCH.

Item 2: USB device records from the LT-114 image

code
Device:          USB mass storage "Generic USB Disk 3.0"
Serial number:   0712A9C4F00185
First connected: 08 Jun 19:02:11   (Windows device-installation log)
Last removed:    10 Jun 19:47:05   (SYSTEM registry device properties, last removal time)
Volume label:    BACKUP   Drive letter: E:
Mounted by:      KELVORN\talbright  (user registry hive)
Device recovered: NO

Item 3: Shortcut (recent-file) records in the talbright profile

code
10 Jun 19:24:37  E:\T-900\blade_profile_v12.step
                 (target on removable volume labeled BACKUP)
10 Jun 19:26:02  E:\T-900\T-900 Specification Summary.pdf

Item 4: Cloud file-sharing audit log (exported by Kelvorn's administrator on 16 Jun; export file hashed)

code
10 Jun 19:12:44  FileDownloaded (bulk)  user talbright@kelvorn.example
                 IP 198.51.100.23 (Kelvorn office network, per IT)
                 Library "T-900 Design" · 214 files
10 Jun 19:18:09  Bulk download completed

Item 5: Email (Kelvorn's mail service)

code
11 Jun 08:41:16  From: talbright@kelvorn.example
                 To:   tomas.albright@mail.example
                 Subject: personal stuff
                 Sent via webmail from IP 203.0.113.77
                 Attachment: photos.zip (18.2 MB)
                 SHA-256 733efab7acf4a1f5c5b7d634ddc9bcdf1d9f481dd4b3fab1d4552c8423a1dae0
  Contents of photos.zip:
     family_trip.jpg  SHA-256 5f47b258b0c9669baa3d2a36b932d40049cf3af6a7df4611f22905d7b60ab87a
     summary.pdf      SHA-256 64e2a88f0cd3b4a2d7495f21c18a46fb9d265122f71df50e5728c1a0dfa5627e

Cloud library file "T-900 Specification Summary.pdf"
                 SHA-256 64e2a88f0cd3b4a2d7495f21c18a46fb9d265122f71df50e5728c1a0dfa5627e

Item 6: Building access (badge system export)

code
10 Jun 18:51  Badge talbright: IN, main entrance
10 Jun 20:06  Badge talbright: OUT, main entrance

Item 7: Windows Security log, LT-114 (from the image)

code
10 Jun 18:58  Event 4624  Logon  KELVORN\talbright  (interactive)
11 Jun 09:00  Event 4624  Logon  KELVORN\it-svc     (scheduled patching)
No logon events between 12 Jun 17:30 and 15 Jun 10:05.

Item 8: Statements

  • Albright, exit meeting on 12 June: "I only took some personal photos home."
  • R. Osei, IT manager: LT-114 sat in an unlocked cupboard in the IT office from 12 to 15 June.

Your Tasks

  1. Timeline. Put every event in time order, with its source item. Mark anything uncertain.
  2. Evidence and integrity. For each item, note what it shows and how its integrity is established, and identify any weakness.
  3. Limits. List at least five things the evidence does not establish.
  4. The report. Write a condensed court-style report using the structure from Lesson 6.3.
  5. Cross-examination. Prepare answers to three hard questions you would expect from Albright's lawyer.

Check Your Work

This capstone is self-assessed: nothing you produce here is submitted to or graded by the Academy. Write your timeline, evidence table, limits, report and cross-examination answers before you read the model solution. Then rate your work against the rubric below, and only then compare it with the model solution.

Timeline

Meets the standard: Every event in time order, in UTC, with its source item; uncertain times marked.

Not yet: Events missing, times mixed or unsourced.

Evidence and integrity

Meets the standard: For each item: what it shows, how its integrity is established and its weakness; the custody gap discussed honestly.

Not yet: Items accepted at face value, or the custody gap ignored.

Limits

Meets the standard: At least five, including account versus person, the unrecovered USB device, and no evidence that the competitor received anything.

Not yet: Conclusions about guilt or intent that the evidence cannot support.

Report

Meets the standard: Follows the structure from Lesson 6.3; facts kept apart from interpretation; methodology names tools, versions and hashes; limitations stated; plain language.

Not yet: Opinions presented as findings, or no methodology or limitations.

Cross-examination

Meets the standard: Answers stay within the evidence, concede real limits and correct false premises politely.

Not yet: Overclaiming, guessing or arguing.

Model Solution

Task 1 — Timeline (UTC)

TimeEventSource
08 Jun 19:02USB device (serial ending F00185) first connected to LT-114Item 2
10 Jun 18:51Albright's badge enters the buildingItem 6
10 Jun 18:58Interactive logon to LT-114 as KELVORN\talbrightItem 7
10 Jun 19:12–19:18Bulk download of 214 files from "T-900 Design" by talbright@kelvorn.example from the Kelvorn office networkItem 4
10 Jun 19:24–19:26Shortcut records show T-900 files opened from E:\T-900 on the volume labeled BACKUPItem 3
10 Jun 19:47USB device last removedItem 2
10 Jun 20:06Albright's badge leaves the buildingItem 6
11 Jun 08:41Email from talbright@kelvorn.example to tomas.albright@mail.example, sent via webmail from 203.0.113.77, with photos.zip containing a file identical to the T-900 Specification SummaryItem 5
11 Jun 09:00it-svc logon for scheduled patchingItem 7
12 Jun (time not recorded)Albright resigns with immediate effect and joins Brindlecove EnergyThe Case
12 Jun 17:30LT-114 returned at the exit meeting, where Albright says he only took personal photos home; laptop stored in an unlocked cupboardItems 1, 8
12 Jun 17:30 – 15 Jun 10:05No logon events on LT-114Item 7
15 Jun 10:05LT-114 collected by the examiner and sealed in bag 66310Item 1
15 Jun 10:40BitLocker recovery key retrieved; imaging through a tested write-blocker begins; source and image hashes matchItem 1
16 JunCloud audit log exported by Kelvorn's administrator; export file hashedItem 4
22 JunBrindlecove presents a blade design that Kelvorn's engineers say closely resembles T-900The Case

Uncertain: the time of the resignation on 12 June, and the exact time files were copied to the USB device. The shortcut records show files being opened from E: at 19:24–19:26, which means they were on the device by then, not exactly when they were written to it.

Task 2 — Evidence and integrity

ItemWhat it showsIntegrityWeakness
1 AcquisitionLT-114 image is an exact copy as of 15 JunMatching SHA-256, tested write-blockerCustody gap 12–15 Jun (unlocked cupboard, no entries)
2 USB recordsA specific USB device used under talbright's account on 8–10 JunFrom the verified imageDevice not recovered; contents unknown beyond Item 3
3 ShortcutsT-900 files present on E: on 10 JunFrom the verified imageShow presence and opening, not the act of copying
4 Cloud audit214 T-900 files downloaded under talbright's account from the officeExport hashed at collection; provider's own logAccount-level record; does not identify the person
5 EmailSpecification Summary sent to a personal address under the name summary.pdfHash match to the cloud original; record from Kelvorn's mail serviceSent via webmail, so possibly from any device
6 BadgeAlbright's badge in the building 18:51–20:06Badge system exportA badge shows a card, not a person
7 Logonstalbright logon at 18:58; no logons during the custody gapFrom the verified imageit-svc patching on 11 Jun must be considered
8 StatementsAlbright denies taking work files; IT confirms storage conditionsWitness statementsNot forensic evidence; context only

The custody gap matters, but its impact is limited. The key artifacts (Items 2, 3 and 7) record events before 12 June. The Security log shows no logons during the gap. The cloud and email records (Items 4 and 5) come from Kelvorn's services, not from the laptop. The report must state the gap honestly and explain why it does not undermine these particular findings.

Task 3 — What the evidence does not establish

  1. That Albright personally performed the actions: the records show his account and badge, not the person at the keyboard.
  2. What the USB device contains now, or where it is: it was not recovered.
  3. That all 214 files were copied to the USB device: only two are shown on E: by shortcut records.
  4. That Brindlecove Energy received or used any Kelvorn file.
  5. That nothing on LT-114 changed during the 12–15 June gap: the hash proves integrity only from 15 June onward, although the logon records and the dates of the key artifacts reduce the concern.
  6. Where the 11 June email was sent from: 203.0.113.77 is a connection address, and identifying its subscriber would need provider records obtained through legal process.

Task 4 — Model report (condensed)

IT Forensic Analysis Report · Case: KELVORN-2026-014 (fictional) · Examiner: [name and qualifications] · Date: 30 June 2026

1. Executive summary. Records from Kelvorn's laptop LT-114, its cloud file-sharing service and its email service show that, on the evening of 10 June 2026, 214 files from the confidential "T-900 Design" library were downloaded under the account talbright@kelvorn.example from the Kelvorn office network, and that two T-900 files were opened from a USB device connected to LT-114 under the same account. On 11 June, an email from that account to tomas.albright@mail.example carried a file identical in content (matching SHA-256) to the T-900 Specification Summary, named summary.pdf inside an archive called photos.zip. The records identify accounts, a badge and a device; they do not by themselves identify the person who performed the actions.

2. Introduction and scope. Instructed in writing by Kelvorn's General Counsel to examine Kelvorn-owned systems: laptop LT-114, the Kelvorn cloud file-sharing tenant and the Kelvorn email service. Personal devices of Mr. Albright were outside scope and were not examined.

3. Methodology. LT-114's SSD was imaged on 15 June 2026 through a tested hardware write-blocker, using [tool and version]; the BitLocker recovery key was obtained from Kelvorn's directory service; the image was verified (SHA-256 462d…7eea, source and image identical). Artifacts were analyzed with [tools and versions], validated against [reference data]. The cloud audit log was exported by Kelvorn's administrator on 16 June and the export file hashed; the examiner verified that hash. The email record from Kelvorn's mail service lists the SHA-256 values of the attachment and its contents. File identity was established by SHA-256 comparison. All times are UTC.

4. Findings.

  • 4.1 USB device. A USB storage device, serial 0712A9C4F00185, volume label BACKUP, was first connected to LT-114 on 8 June at 19:02 and last removed on 10 June at 19:47, mounted by KELVORN\talbright.
  • 4.2 Cloud downloads. On 10 June, 19:12–19:18, 214 files were downloaded from the "T-900 Design" library by talbright@kelvorn.example from 198.51.100.23, which Kelvorn IT identifies as the office network.
  • 4.3 Files on the USB device. Shortcut records show E:\T-900\blade_profile_v12.step opened at 19:24 and E:\T-900\T-900 Specification Summary.pdf at 19:26 on 10 June, from the volume labeled BACKUP.
  • 4.4 Physical access and logon. Badge records show the card of T. Albright entering at 18:51 and leaving at 20:06 on 10 June. LT-114 recorded an interactive logon by KELVORN\talbright at 18:58.
  • 4.5 Email. On 11 June at 08:41, talbright@kelvorn.example sent an email to tomas.albright@mail.example via webmail from 203.0.113.77, attaching photos.zip. Its file summary.pdf has the same SHA-256 as the T-900 Specification Summary.

5. Analysis and interpretation. The sequence (badge entry, logon, bulk download, T-900 files opened from the USB device, device removed, badge exit) is consistent with T-900 files being downloaded and placed on the USB device during that visit. The 11 June email shows the Specification Summary sent outside the company under a non-descriptive name inside an archive named photos.zip. The renaming is consistent with an attempt to make the attachment look personal, but the evidence does not show who chose the names or why. An it-svc logon on 11 June was a scheduled patching task and does not affect the 10 June findings.

6. Integrity and limitations. LT-114 was stored in an unlocked cupboard from 12 to 15 June with no custody records. The image's hash establishes integrity from 15 June onward only. However, the findings in 4.1, 4.3 and 4.4 concern events before 12 June, the Security log records no logons during the gap, and the findings in 4.2 and 4.5 come from Kelvorn's cloud and email services, not from LT-114. The USB device was not recovered, so its full contents are unknown. The records identify accounts, a device and a badge, not the individual using them. Identifying the subscriber of 203.0.113.77 would need provider records obtained by legal process.

7. Conclusion. Within the scope examined, the evidence shows that confidential T-900 material was downloaded under Mr. Albright's company account, was present on a USB device used under his account on LT-114 on 10 June, and that an identical copy of the T-900 Specification Summary was emailed from his company account to an external address on 11 June. Whether Mr. Albright personally carried out these actions, and whether the material reached Brindlecove Energy, are matters for other evidence and for the court.

8. Recommendations. Seek, through counsel, recovery of USB serial 0712A9C4F00185; consider legal process for the subscriber of 203.0.113.77 and for the external mailbox; secure custody procedures for returned equipment; add alerts for bulk downloads from confidential libraries.

9. Appendices. A: chain-of-custody record and custody-gap statement. B: hash list (image, export files, attachment, cloud original). C: raw artifact extracts with sources. D: glossary (hash, shortcut record, audit log, write-blocker).

Task 5 — Cross-examination

Q: "The laptop sat unlocked in a cupboard for three days. Anyone could have planted these records." A: "The custody gap is real and I've set it out in my report. Three things limit its effect. The Security log records no logons during that period. The key artifacts record events from 8 to 10 June. And the cloud download and the email come from Kelvorn's own services, not from the laptop, and they agree with the laptop records."

Q: "You can't say my client was at that keyboard, can you?" A: "Correct. The records show his account, his badge and a USB device mounted under his account. They don't identify the person at the keyboard. My report says so in sections 1 and 6."

Q: "summary.pdf could be any summary. Why do you say it's Kelvorn's specification?" A: "Because its SHA-256 value is identical to that of Kelvorn's T-900 Specification Summary. A match of that kind means the contents are identical, whatever the file is called. I haven't relied on the name at all."

Key Takeaways

  • A strong timeline combines independent sources (device, cloud, email and building access), each cited.
  • Hash matching identifies renamed files; shortcut and USB records place files on devices; audit logs show account actions.
  • Report weaknesses such as a custody gap openly, and explain precisely what they do and do not affect.
  • Findings describe accounts, devices and badges. Conclusions about people are drawn carefully, or left to the court.

Sources

Next
PreviousCapstone A: The Evidence Lab — Hash, Image and ExamineNextFinal Self-Assessment: 20 Questions