The sources and scenario.
The primary source is my DIGITAL FORENSICS ASSIGNMENT.docx, dated 11 October 2024. It describes four supplied evidence sets in a fictional missing-person scenario. A separate 34-page PDF, Digital Forensic Analysis Report, dated 16 October 2024, contains actual screenshots. The DOCX has no embedded images and leaves several screenshot locations as text instructions. The versions are not identical, so I use the DOCX for method and claim wording and the PDF only for visually checked steps that agree with it. Neither complete report is public.
No original disk image, packet capture, memory dump or phone database was rerun for this page. The published images are deterministic crops of the PDF's original figures, not reconstructed outputs. The chosen crops avoid recovered passwords, email addresses, phone numbers and private message bodies.
Selected original figures.
Six figures appear in the case study: PDF page 5, the mmls partition table; page 7, RegRipper UserAssist output; page 15, Wireshark HTTP headers; page 16, a followed FTP control stream; page 21, Volatility pstree; and page 25, an SQLite query returning fictional contact display names. The page 7 crop excludes unrelated Volatility output below the registry records. These support specific analysis operations, not the full narrative conclusion. Each figure opens at full resolution from the article.
Integrity and custody are incomplete.
The DOCX describes MD5 and SHA-1 commands, but the appendix leaves several expected hash fields blank. Its chain-of-custody appendix is descriptive rather than a complete acquisition and transfer log. The PDF includes some terminal hash output, but does not repair all missing values or prove every supplied item was verified throughout the exercise. I therefore do not claim a complete, independently auditable chain of custody or validated hashes for every image.
Observation is not attribution.
A user profile and generic Windows registration field do not prove who used the desktop. A time-zone configuration does not prove where the person was. UserAssist and process names suggest activity to investigate, not the reason for it. HTTP user-agent text is client-reported. The FTP control stream shows a transfer command and server response, not the file's actual contents. Browser-like strings in a memory dump are not validated visit records, particularly because the reported SQLite recovery and YARA search did not complete successfully.
On the phone, contact names, messages and searches offer context but require provenance, timestamp alignment and corroboration. The case study omits private communication details. The 3 August journal entry expresses a plan, but the proposed voluntary-disappearance outcome remains a hypothesis within the fictional exercise. Interviews, identity checks and an extended timeline were proposed follow-ups, not completed work in the source.
A stronger investigation.
I would preserve complete acquisition records and hashes, retain exact command/output references, record clock offsets and time zones for each source, and document alternatives beside each finding. Sensitive artefacts would remain in restricted storage, with only necessary redacted extracts used publicly. These are improvements I would make, not procedures I claim were completed in the coursework.