Part VII Checkpoint: Which Technique Cracked It?
Where you are: Part VII — Landmark Cases · Checkpoint · This checkpoint brings together Chapter 14 of Dr. Al-Doori's IT Forensics Essentials: ten landmark cases and the techniques that solved them.
Part VII Checkpoint: Which Technique Cracked It?
You have finished Part VII. Each scenario below is fictional, but each echoes one of the book's landmark cases. Choose the technique and the reasoning that fit, and then read the model answer. There is no score to record. Allow about 12 minutes.
Scenario 1: The Anonymous Letters
A city council receives a series of threatening letters as attached Word documents from a free webmail account. The latest attachment's document properties show an author name, "R. Fenwright", and a company name, "Quillbrook Freight".
Which statement best reflects the lessons of the BTK case?
Model answer: a. In the BTK case, metadata produced a suspect, and DNA and other evidence confirmed him. Here, "R. Fenwright" might be the writer, a colleague whose template was reused, or someone being framed, because author fields can be edited. Corroboration, from provider records, device evidence and access to the computers involved, turns a lead into evidence. Options b and c are opposite errors.
Scenario 2: The Ransom in Bitcoin
A hospital paid a ransom in Bitcoin before involving investigators. Analysis shows the payment moved through several addresses and some of it reached a large exchange two weeks later.
What can cryptocurrency tracing realistically offer?
Model answer: c. The ledger is public and addresses are pseudonymous, so funds can be followed. When they reach an exchange that knows its customers, legal process can connect them to an account. As in Silk Road, this works best combined with other evidence, and conclusions should carry stated confidence. Option a is wrong; option b and option d overpromise.
Scenario 3: The Boast
A company's customer database appears for sale on a criminal forum. The seller's post includes a screenshot showing a cloud storage console with the company's account name. The company's cloud audit logging was switched on.
Which first steps best follow the lessons of the Capital One case?
Model answer: d. In the Capital One case, a public post and cloud logs were decisive, and the cause was a configuration problem. Preserving the post, which can disappear at any moment, securing the logs before retention expires, examining the configuration and involving law enforcement mirror that path. Option a destroys evidence. Option c funds criminals and may be unlawful. Option b assumes a conclusion the evidence has not reached.
Before You Move On
If any of these felt uncertain, revisit the lesson behind it: Lesson 7.1 for metadata, Lesson 7.2 for malware and attribution, Lesson 7.3 for cryptocurrency and cloud logs, and Lesson 7.4 for accounts and phones. Next comes the Capstone: an evidence lab, a full case with a court report, and the final assessment.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 14
- Lawrence Journal-World (Associated Press) — Computer disk, DNA and messages helped lead police to BTK suspect (4 March 2005)
- US Attorney's Office, Western District of Washington — United States v. Paige Thompson
- KQED — The 2013 SF Sting That Captured Ross Ulbricht, Silk Road Operator Pardoned by Trump (23 January 2025)
- No More Ransom (Europol, Dutch police and partners)