Part III Checkpoint: Choose the Technique
Where you are: Part III — DFIR, Services and Techniques · Checkpoint · This checkpoint brings together Chapters 3 to 5 of Dr. Al-Doori's IT Forensics Essentials: DFIR, the incident response lifecycle, forensic services and the core techniques.
Part III Checkpoint: Choose the Technique
You have finished Part III. This checkpoint gives you three short, realistic situations. Each one asks you to choose the right technique for the problem. Read the scenario, choose what you would do, and then read the model answer. There is no score to record. Allow about 15 minutes.
All people, organizations, domains and addresses below are fictional; the addresses come from ranges reserved for documentation.
Scenario 1: The Formatted Memory Card
Police investigating a burglary seize a camera found in a suspect's car. Its memory card has been formatted. Detectives hope it once held photos of the burgled house.
Which approach fits best?
Model answer: c. Formatting usually rebuilds the file system's records, so deleted-file recovery has little to work with. Carving the image for JPEG signatures is the right technique. Work on a verified image, and report that carved photos lose their original names and file-system dates, although many photos carry their own internal metadata. Browsing on an office computer (a) risks changing the card. Option b gets it backwards. Option d is too pessimistic: a quick format, the usual kind, rebuilds the file system without overwriting the photo data. A full format on Windows Vista and later does write zeros over the whole volume, so find out, if you can, how the card was formatted.
Scenario 2: Thursday Night at the Warehouse
A warehouse company's stock database was altered on Thursday night, hiding missing goods. The investigator has the database server's logs, the Windows Security logs of an office PC, the building's door-entry records and NTFS timestamps from the PC's image. One of the clocks is known to run eight minutes fast.
What is the best way to work out who did what, and when?
Model answer: d. No single source is enough. NTFS times can be changed and access times are unreliable. Door-entry records show a badge, not a keyboard. Correlating all of them, after correcting the eight-minute offset and converting everything to UTC, shows whether, for example, a badge entered at 22:31, a logon succeeded at 22:34 and the database changed at 22:37. Options a and c each lean on one weak source. Interviews (b) matter, but they do not replace the evidence.
Scenario 3: The Header Says…
A company's finance officer received a payment request apparently from the CEO. The header shows, from the top down:
Received: from mx.example.com ([198.51.100.7]) by mail.company.example
Received: from [192.0.2.66] by mx.example.com
Authentication-Results: mail.company.example; spf=pass; dkim=pass; dmarc=pass
(domain checked: company-exec.example)
From: "CEO" <ceo@company-exec.example>
What can the investigator correctly conclude?
Model answer: b. Reading bottom-up, the earliest recorded hop is 192.0.2.66. The top line was added by the company's own server, so it reliably shows the message arriving from mx.example.com. The line below it was written by that outside server, so 192.0.2.66 is a strong lead to confirm, for example from that provider's logs. Authentication passed, but for company-exec.example, not for company.example, which is the classic look-alike pattern. An IP address identifies a connection, not a person, and it could be a rented server or a VPN (c). Option a confuses "authenticated" with "genuine". Option d overreaches: the Received lines added by servers you trust, usually your own organization's, are reliable records. Earlier lines, and fields the sender writes such as From, can be forged, so treat them as leads.
Before You Move On
If any of these felt uncertain, revisit the lesson behind it: Lesson 3.5 for recovery and carving, Lesson 3.6 for timelines and logs, and Lesson 3.7 for email headers. Next, Part IV turns to integrity: the ethics of forensic science, write-blockers and the language of security.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapters 3–5
- NIST — IR 8354: Digital Investigation Techniques: A NIST Scientific Foundation Review (November 2022)
- IETF — RFC 5322: Internet Message Format
- Microsoft Learn — Change in the behavior of the format command in Windows Vista and later versions
- IETF — RFC 5737: IPv4 Address Blocks Reserved for Documentation
- Microsoft Learn — fsutil behavior (Last Access Time updates)